Trying to help my sister in law with her computer but have run into a snag. She has Antivirus plus (fake evil program) on her computer and I have tried to take it off. I ran ad aware and hijack this, and tried to install malware bytes. Something blocks the installation program of malware bytes and I can't run it. I have now followed your instructions I think and will copy and attach the root repeal and DDS reports. Hope you can help!

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/10/22 19:12
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB0D82000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF79FB000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xADF01000 Size: 49152 File Visible: No Signed: -
Status: -

SSDT
-------------------
#: 041 Function Name: NtCreateKey
Status: Hooked by "Lbd.sys" at address 0xf764787e

#: 247 Function Name: NtSetValueKey
Status: Hooked by "Lbd.sys" at address 0xf7647bfe

==EOF==

DDS (Ver_09-10-13.01) - NTFSx86
Run by Kathy at 19:40:37.01 on Thu 10/22/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1078 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\DVDRAMSV.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kathy\Local Settings\Temporary Internet Files\Content.IE5\TBHT4Q72\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.micros oft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [Kathy] c:\documents and settings\kathy\Kathy.exe /i
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Toshiba Hotkey Utility] "c:\program files\toshiba\windows utilities\Hotkey.exe" /lang en
mRun: [PadTouch] c:\program files\toshiba\touch and launch\PadExe.exe
mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [Notebook Maximizer] c:\program files\notebook maximizer\maximizer_startup.exe
mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [gomayabuk] Rundll32.exe "c:\windows\system32\matihoji.dll",a
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpd igi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpi mag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ram asst.lnk - c:\windows\system32\RAMASST.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_02\bin\npjpi150_02.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: turbotax.com
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1256241269125
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: c:\windows\system32\matihoji.dll,yozekute.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: ritayatep - {73a99f4e-164a-4946-8adf-f203408dd239} - c:\windows\system32\matihoji.dll
STS: gahurihor: {73a99f4e-164a-4946-8adf-f203408dd239} - c:\windows\system32\matihoji.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, mcenspc.dll, digiwet.dll
LSA: Notification Packages = scecli svdhl1.dll piwinala.dll sonosuje.dll

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

Hello Thecloser, Welcome to the forum!

Thanks for the logs, that will enable our talented security team to help you quicker

Someone will be with you as soon as possible!

Regards,

Smokeycheech

You still have some of the malware installed....

You will need to download ComboFix.exe. Download Combofix from any of the links below. You must rename it before saving it. Name it ComFx, and Save it to your desktop.


http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe


* IMPORTANT !!! Save ComboFix.exe to your Desktop
It is important that it is saved and renamed following this process directly to your desktop**


Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools. More help on your specific AV here: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Double click on ComFx.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.




Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes to continue scanning for malware.
When finished, it shall produce a log for you. Please include the ComboFix.txt in your reply.

Caution.....
Never use this program to remove files.Only use it with help from an experienced user.Wrongful use can damage your computer.

Here is the combofix log. Do I need to do anything else? What software do you recommend to prevent getting this type of malware?
Thank you!


ComboFix 09-10-28.08 - Kathy 10/29/2009 10:13.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1465 [GMT -5:00]
Running from: c:\documents and settings\Kathy\Desktop\ComFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\buxuhto.exe
c:\documents and settings\All Users\Start Menu\Programs\AntiVirus Plus
c:\documents and settings\All Users\Start Menu\Programs\AntiVirus Plus\AntiVirus Plus.lnk
c:\documents and settings\All Users\Start Menu\Programs\AntiVirus Plus\EULA.url
c:\documents and settings\Kathy\Start Menu\Programs\AntiVirus Plus
c:\documents and settings\Kathy\Start Menu\Programs\AntiVirus Plus\AntiVirus Plus.lnk
c:\documents and settings\Kathy\Start Menu\Programs\AntiVirus Plus\EULA.url
C:\p2hhr.bat
c:\program files\Antivirus Plus
c:\program files\Antivirus Plus\AntiVirus Plus.7036701049.exe
c:\program files\WinPCap
c:\program files\WinPCap\rpcapd.exe
c:\recycler\S-1-5-21-4248637238-1128673168-1010321132-1003
c:\windows\ewazuvif.dll
c:\windows\iyosurasewisu.dll
c:\windows\svdhl1.dll
c:\windows\system32\AVR09.exe
c:\windows\system32\domisuja.dll.tmp
c:\windows\system32\drivers\gasfkypmxnwrsw.sys
c:\windows\system32\drivers\npf.sys
c:\windows\system32\fatenuva.dll
c:\windows\system32\garepure.dll
c:\windows\system32\hajigira.dll
c:\windows\system32\jihakera.dll.tmp
c:\windows\system32\jihuwiyo.dll
c:\windows\system32\kesezila.dll
c:\windows\system32\kuzogago.dll
c:\windows\system32\najejifo.dll
c:\windows\system32\Packet.dll
c:\windows\system32\pipidiwo.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\sapinisa.dll.tmp
c:\windows\system32\toyuwipi.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\winhelper.dll
c:\windows\system32\wpcap.dll
c:\windows\system32\zasulege.dll
c:\windows\system32\zavidegu.dll

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it
c:\windows\system32\proquota.exe was missing
Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_acpi32
-------\Service_ati64si
-------\Service_fips32cup
-------\Service_i386si
-------\Service_ksi32sk
-------\Service_nicsk32
-------\Service_npf
-------\Service_port135sik


((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-29 )))))))))))))))))))))))))))))))
.

2009-10-29 15:21 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-10-29 15:21 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-10-29 14:57 . 2009-10-29 14:58 57 ----a-w- c:\windows\system32\fxscfgwy.dat
2009-10-29 14:57 . 2009-10-29 14:58 57 ----a-w- c:\windows\system32\wcaprtho.dat
2009-10-29 14:57 . 2009-10-29 14:57 0 ----a-w- c:\windows\system32\adsnhxa.dat
2009-10-29 14:57 . 2009-10-29 15:24 309 ----a-w- c:\windows\system32\winipsec.dat
2009-10-29 14:57 . 2009-10-29 15:24 309 ----a-w- c:\windows\system32\routetai.dat
2009-10-29 14:57 . 2009-10-29 15:23 0 ----a-w- c:\windows\system32\MSRDO2A.dat
2009-10-29 14:57 . 2009-10-29 14:57 231 ----a-w- c:\windows\system32\kbdiamal.dat
2009-10-25 12:38 . 2009-10-29 14:46 0 ----a-w- c:\windows\Xvitalegetek.bin
2009-10-25 12:38 . 2009-10-28 14:49 120 ----a-w- c:\windows\Rtijodet.dat
2009-10-25 12:38 . 2009-10-25 12:38 -------- d-----w- c:\documents and settings\Kathy\Local Settings\Application Data\{CEE8FEC6-F30A-46C5-AC12-AA903B839B20}
2009-10-22 21:35 . 2009-10-29 14:49 -------- dc-h--w- c:\documents and settings\All Users\Application Data\~0
2009-10-22 21:35 . 2009-10-29 14:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-22 21:35 . 2009-10-22 21:35 -------- d-----w- c:\program files\Lavasoft
2009-10-22 20:22 . 2009-10-22 20:22 -------- d-----w- c:\program files\Trend Micro
2009-10-20 02:19 . 2009-10-20 02:19 -------- d-----w- c:\documents and settings\Kathy\Application Data\Malwarebytes
2009-10-20 02:18 . 2009-10-20 02:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-20 01:39 . 2009-10-20 02:35 -------- d-----w- c:\program files\gsfkbc
2009-10-20 01:38 . 2009-10-20 01:38 27648 ----a-w- C:\vyiy.exe
2009-10-20 01:38 . 2009-10-20 01:38 22016 ----a-w- C:\wggam.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-10-22 18:30 . 2009-04-03 12:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-22 18:23 . 2008-04-01 02:11 -------- d-----w- c:\program files\McAfee
2009-09-29 11:31 . 2006-06-19 01:30 -------- d-----w- c:\documents and settings\Kathy\Application Data\Apple Computer
2009-09-29 11:23 . 2009-09-29 11:21 -------- d-----w- c:\program files\iTunes
2009-09-29 11:23 . 2009-09-29 11:21 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-29 11:21 . 2006-06-19 01:25 -------- d-----w- c:\program files\iPod
2009-09-29 11:21 . 2008-04-26 14:56 -------- d-----w- c:\program files\Common Files\Apple
2009-09-29 11:17 . 2009-09-29 11:16 -------- d-----w- c:\program files\QuickTime
2009-09-29 10:57 . 2009-05-03 15:02 -------- d-----w- c:\program files\Safari
2009-09-18 22:50 . 2008-04-01 02:06 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-09-16 15:22 . 2008-04-01 02:12 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 15:22 . 2008-04-01 02:12 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 15:22 . 2008-04-01 02:12 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 15:22 . 2008-04-01 02:12 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 15:22 . 2008-04-01 02:12 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-09-11 14:18 . 2005-08-09 20:38 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-08 04:38 . 2009-09-08 04:37 -------- d-----w- c:\documents and settings\Kathy\Application Data\HpUpdate
2009-09-08 04:38 . 2006-02-02 02:55 -------- d-----w- c:\program files\HP
2009-09-04 21:03 . 2005-08-09 20:38 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2005-08-09 20:38 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2005-08-09 20:39 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-25 03:31 . 2009-08-25 03:31 37012 ---ha-w- c:\windows\system32\mlfcache.dat
2009-08-18 03:17 . 2006-01-21 17:57 41504 -c--a-w- c:\documents and settings\Kathy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:01 . 2005-08-09 20:38 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 01:44 . 2005-08-09 20:38 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2004-08-03 22:59 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-28 14:50 . 2009-07-28 14:50 39424 --sha-w- c:\windows\system32\dowileyi.dll
2009-07-20 01:45 . 2009-07-20 01:45 27648 --sha-w- c:\windows\system32\fejolave.exe
2009-07-26 23:12 . 2009-07-26 23:12 53248 --sha-w- c:\windows\system32\figepevo.dll
2009-07-26 23:11 . 2009-07-26 23:11 39424 --sha-w- c:\windows\system32\jaguvonu.dll
2009-07-29 14:35 . 2009-07-29 14:35 39424 --sha-w- c:\windows\system32\kiseluzo.dll
2009-07-27 11:36 . 2009-07-27 11:36 39424 --sha-w- c:\windows\system32\lesufuya.dll
2009-07-22 01:01 . 2009-07-22 01:01 91648 --sha-w- c:\windows\system32\modubelo.dll
2009-07-26 23:11 . 2009-07-26 23:11 53248 --sha-w- c:\windows\system32\nilekefa.dll
2009-07-20 01:45 . 2009-07-20 01:45 91136 --sha-w- c:\windows\system32\rakedega.dll
2009-07-21 00:02 . 2009-07-21 00:02 91648 --sha-w- c:\windows\system32\woserali.dll
2009-07-27 23:53 . 2009-07-27 23:53 39424 --sha-w- c:\windows\system32\yufarugo.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f9fd14eb-acf9-4840-a9f4-611939ea421a}]
2009-07-26 23:12 53248 --sha-w- c:\windows\system32\figepevo.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\kb diamal]
@="{08BAD9B8-D926-C410-C5DE-9F4A5BDE3586}"
[HKEY_CLASSES_ROOT\CLSID\{08BAD9B8-D926-C410-C5DE-9F4A5BDE3586}]
2008-04-14 00:09 131072 ----a-w- c:\windows\system32\kbdiamal.ocx

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-29 344064]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 688218]
"Toshiba Hotkey Utility"="c:\program files\Toshiba\Windows Utilities\Hotkey.exe" [2005-10-18 1261568]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-09-07 1077301]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-18 151552]
"Notebook Maximizer"="c:\program files\Notebook Maximizer\maximizer_startup.exe" [2004-05-25 28672]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-07-10 645328]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-29 53248]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2005-8-9 155648]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AntiVirus Plus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AntiVirus Plus.lnk
backup=c:\windows\pss\AntiVirus Plus.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Kathy^Start Menu^Programs^Startup^AntiVirus Plus.lnk]
path=c:\documents and settings\Kathy\Start Menu\Programs\Startup\AntiVirus Plus.lnk
backup=c:\windows\pss\AntiVirus Plus.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\ati2evxx.exe"=
"c:\\Program Files\\McAfee.com\\Agent\\mcagent.exe"=
"c:\\WINDOWS\\system32\\HPZipm12.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE"=

R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFH WATI.sys [3/31/2005 7:08 PM 211200]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - MBR
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-07-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:34]

2009-09-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-04-01 17:22]

2009-10-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-04-01 17:22]

2009-10-29 c:\windows\Tasks\User_Feed_Synchronization-{783EECD9-4DD9-4414-A10A-6C5A99B4C8E4}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.micros oft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: turbotax.com
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Fmawubalikoq - c:\windows\iyosurasewisu.dll
HKLM-Run-gomayabuk - c:\windows\system32\toyuwipi.dll
HKLM-Run-jiziyonube - garepure.dll
SharedTaskScheduler-{a8749650-a29b-4976-8d27-de50c6637163} - c:\windows\system32\toyuwipi.dll
SSODL-laradotuw-{a8749650-a29b-4976-8d27-de50c6637163} - c:\windows\system32\toyuwipi.dll



************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-29 10:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\TEMP\TMP4352$.TMP 0 bytes
c:\windows\system32\wuauclt.exe.wusetup.264953.bak 51224 bytes executable
c:\windows\system32\wuaueng.dll.wusetup.267843.bak 1809944 bytes executable
c:\windows\system32\mucltui.dll 268648 bytes executable
c:\windows\system32\mucltui.dll.mui 27496 bytes executable

scan completed successfully
hidden files: 5

************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2116426121-699555250-1234046695-1006\Software\Microsoft\SystemCertificates\Address Book*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(552)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(216)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\program files\Common Files\Microsoft Shared\INK\PENUSA.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\Software Suite\PhotoImpression\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\system32\DVDRAMSV.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\iPod\bin\iPodService.exe
.
************************************************** ************************
.
Completion time: 2009-10-29 10:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-29 15:31

Pre-Run: 32,788,516,864 bytes free
Post-Run: 32,964,583,424 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 20F66B07DFBA98EBD4B0839649A1C93E

Also, I cannot access Window's update even though I tried the fixes the website recommends. Is this part of the malware or a separate problem?
Thanks!

Please go to Jotti's malware scan at Jotti's malware scan and upload the following file/s one at a time for scanning and post the results back here...

c:\windows\system32\wcaprtho.dat
c:\windows\system32\adsnhxa.dat
c:\windows\system32\routetai.dat
c:\windows\system32\MSRDO2A.dat
c:\windows\system32\kbdiamal.dat
c:\windows\Xvitalegetek.bin
c:\windows\Rtijodet.dat

========================================
Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open *notepad* and copy/paste the red text in the quotebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt
Please copy and paste the ComboFix.txt in your next reply please.

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*

The Jottis scan results found either no malware or empty files for the list of fies I scanned. The last one said :
This file has been scanned before. The results for this previous scan are listed below.

Filename: Wnuqanerulatoqez.dat
Status:
Scan finished. 0 out of 21 scanners reported malware.


Here is the combofix report:
ComboFix 09-10-28.08 - Kathy 10/29/2009 19:11.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1264 [GMT -5:00]
Running from: c:\documents and settings\Kathy\Desktop\ComFix.exe
Command switches used :: c:\documents and settings\Kathy\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FILE ::
"c:\windows\system32\dowileyi.dll"
"c:\windows\system32\fejolave.exe"
"c:\windows\system32\figepevo.dll"
"c:\windows\system32\jaguvonu.dll"
"c:\windows\system32\kiseluzo.dll"
"c:\windows\system32\lesufuya.dll"
"c:\windows\system32\modubelo.dll"
"c:\windows\system32\nilekefa.dll"
"c:\windows\system32\rakedega.dll"
"c:\windows\system32\woserali.dll"
"c:\windows\system32\yufarugo.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\dowileyi.dll
c:\windows\system32\fejolave.exe
c:\windows\system32\figepevo.dll
c:\windows\system32\jaguvonu.dll
c:\windows\system32\kiseluzo.dll
c:\windows\system32\lesufuya.dll
c:\windows\system32\modubelo.dll
c:\windows\system32\nilekefa.dll
c:\windows\system32\rakedega.dll
c:\windows\system32\woserali.dll
c:\windows\system32\yufarugo.dll

.
((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-30 )))))))))))))))))))))))))))))))
.

2009-10-29 17:36 . 2004-08-04 12:00 5632 -c--a-w- c:\windows\system32\dllcache\smimsgif.dll
2009-10-29 17:36 . 2004-08-04 12:00 5632 -c--a-w- c:\windows\system32\dllcache\smierrsy.dll
2009-10-29 17:36 . 2004-08-04 12:00 15872 -c--a-w- c:\windows\system32\dllcache\smierrsm.dll
2009-10-29 17:36 . 2004-08-04 12:00 10240 -c--a-w- c:\windows\system32\dllcache\snmpstup.dll
2009-10-29 17:36 . 2004-08-04 12:00 10240 ----a-w- c:\windows\system32\wbem\snmpstup.dll
2009-10-29 16:41 . 2009-10-29 16:41 -------- d-----w- c:\documents and settings\Kathy\Application Data\CallingID
2009-10-29 16:41 . 2009-10-29 16:41 -------- d-----w- c:\program files\Common Files\scanner
2009-10-29 16:41 . 2009-10-29 16:41 -------- d-----w- c:\program files\CA
2009-10-29 16:40 . 2009-10-29 16:42 -------- d-----w- c:\documents and settings\Kathy\Application Data\comcasttb
2009-10-29 16:40 . 2009-10-29 16:41 -------- d-----w- c:\program files\comcasttb
2009-10-29 16:26 . 2009-10-29 16:26 -------- d-----w- c:\documents and settings\Kathy\Application Data\McAfee
2009-10-29 16:20 . 2009-10-29 16:20 -------- d-sh--w- c:\documents and settings\Kathy\IECompatCache
2009-10-29 15:28 . 2008-10-16 19:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-10-29 15:21 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-10-29 15:21 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-10-29 14:57 . 2009-10-30 00:11 986 ----a-w- c:\windows\system32\wcaprtho.dat
2009-10-29 14:57 . 2009-10-30 00:11 439 ----a-w- c:\windows\system32\fxscfgwy.dat
2009-10-29 14:57 . 2009-10-29 18:14 0 ----a-w- c:\windows\system32\adsnhxa.dat
2009-10-29 14:57 . 2009-10-30 00:19 2262 ----a-w- c:\windows\system32\winipsec.dat
2009-10-29 14:57 . 2009-10-30 00:19 1472 ----a-w- c:\windows\system32\routetai.dat
2009-10-29 14:57 . 2009-10-30 00:18 0 ----a-w- c:\windows\system32\MSRDO2A.dat
2009-10-29 14:57 . 2009-10-29 16:10 318 ----a-w- c:\windows\system32\kbdiamal.dat
2009-10-25 12:38 . 2009-10-29 14:46 0 ----a-w- c:\windows\Xvitalegetek.bin
2009-10-25 12:38 . 2009-10-28 14:49 120 ----a-w- c:\windows\Rtijodet.dat
2009-10-25 12:38 . 2009-10-25 12:38 -------- d-----w- c:\documents and settings\Kathy\Local Settings\Application Data\{CEE8FEC6-F30A-46C5-AC12-AA903B839B20}
2009-10-22 21:35 . 2009-10-29 14:49 -------- dc-h--w- c:\documents and settings\All Users\Application Data\~0
2009-10-22 21:35 . 2009-10-29 14:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-22 21:35 . 2009-10-22 21:35 -------- d-----w- c:\program files\Lavasoft
2009-10-22 20:22 . 2009-10-22 20:22 -------- d-----w- c:\program files\Trend Micro
2009-10-20 02:19 . 2009-10-20 02:19 -------- d-----w- c:\documents and settings\Kathy\Application Data\Malwarebytes
2009-10-20 02:18 . 2009-10-20 02:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-20 01:39 . 2009-10-20 02:35 -------- d-----w- c:\program files\gsfkbc
2009-10-20 01:38 . 2009-10-20 01:38 27648 ----a-w- C:\vyiy.exe
2009-10-20 01:38 . 2009-10-20 01:38 22016 ----a-w- C:\wggam.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-10-29 16:41 . 2007-12-29 14:51 -------- d-----w- c:\documents and settings\Kathy\Application Data\Move Networks
2009-10-29 16:25 . 2008-04-01 02:11 -------- d-----w- c:\program files\McAfee
2009-10-29 16:25 . 2008-04-01 02:06 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-10-22 18:30 . 2009-04-03 12:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-29 11:31 . 2006-06-19 01:30 -------- d-----w- c:\documents and settings\Kathy\Application Data\Apple Computer
2009-09-29 11:23 . 2009-09-29 11:21 -------- d-----w- c:\program files\iTunes
2009-09-29 11:23 . 2009-09-29 11:21 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-29 11:21 . 2006-06-19 01:25 -------- d-----w- c:\program files\iPod
2009-09-29 11:21 . 2008-04-26 14:56 -------- d-----w- c:\program files\Common Files\Apple
2009-09-29 11:17 . 2009-09-29 11:16 -------- d-----w- c:\program files\QuickTime
2009-09-29 10:57 . 2009-05-03 15:02 -------- d-----w- c:\program files\Safari
2009-09-16 15:22 . 2008-04-01 02:12 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 15:22 . 2008-04-01 02:12 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 15:22 . 2008-04-01 02:12 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 15:22 . 2008-04-01 02:12 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 15:22 . 2008-04-01 02:12 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-09-11 14:18 . 2005-08-09 20:38 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-08 04:38 . 2009-09-08 04:37 -------- d-----w- c:\documents and settings\Kathy\Application Data\HpUpdate
2009-09-08 04:38 . 2006-02-02 02:55 -------- d-----w- c:\program files\HP
2009-09-04 21:03 . 2005-08-09 20:38 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2005-08-09 20:38 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2005-08-09 20:39 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-25 03:31 . 2009-08-25 03:31 37012 ---ha-w- c:\windows\system32\mlfcache.dat
2009-08-18 03:17 . 2006-01-21 17:57 41504 -c--a-w- c:\documents and settings\Kathy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-07 00:24 . 2005-08-09 21:16 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 00:24 . 2005-08-09 21:16 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 00:24 . 2005-08-09 21:16 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 00:24 . 2005-05-26 12:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 00:24 . 2005-08-09 21:16 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-07 00:24 . 2005-08-09 20:37 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 00:23 . 2005-08-09 21:16 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 00:23 . 2005-08-09 21:16 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-07 00:23 . 2008-10-16 19:07 215904 ----a-w- c:\windows\system32\muweb.dll
2009-08-05 09:01 . 2005-08-09 20:38 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 01:44 . 2005-08-09 20:38 2189184 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2004-08-03 22:59 2066048 ------w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-10-29_15.25.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-29 17:59 . 2009-10-29 17:59 16384 c:\windows\Temp\Perflib_Perfdata_970.dat
+ 2009-10-30 00:19 . 2009-10-30 00:19 16384 c:\windows\Temp\Perflib_Perfdata_39c.dat
+ 2008-09-17 02:50 . 2008-04-14 00:12 39936 c:\windows\system32\wbem\snmpthrd.dll
+ 2009-10-29 17:36 . 2004-08-04 12:00 15872 c:\windows\system32\wbem\snmp\smierrsm.dll
+ 2009-10-29 15:27 . 2009-08-07 00:24 44768 c:\windows\system32\SoftwareDistribution\Setup\Ser viceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2009-10-29 15:27 . 2009-08-07 00:24 35552 c:\windows\system32\SoftwareDistribution\Setup\Ser viceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 33280 c:\windows\system32\snmp.exe
+ 2005-08-09 20:38 . 2009-10-29 17:36 74766 c:\windows\system32\perfc009.dat
+ 2008-09-17 02:50 . 2008-04-14 00:11 33792 c:\windows\system32\lmmib2.dll
+ 2008-09-17 02:49 . 2008-04-14 00:11 39936 c:\windows\system32\hostmib.dll
+ 2008-09-17 02:49 . 2008-04-14 00:12 92160 c:\windows\system32\evntwin.exe
+ 2008-09-17 02:49 . 2008-04-14 00:12 24064 c:\windows\system32\evntcmd.exe
+ 2005-08-09 21:16 . 2009-08-07 00:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2005-08-09 21:16 . 2009-08-07 00:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2008-09-17 02:50 . 2008-04-14 00:12 39936 c:\windows\system32\dllcache\snmpthrd.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 33280 c:\windows\system32\dllcache\snmp.exe
+ 2008-09-17 02:50 . 2008-04-14 00:11 33792 c:\windows\system32\dllcache\lmmib2.dll
+ 2008-09-17 02:49 . 2008-04-14 00:11 39936 c:\windows\system32\dllcache\hostmib.dll
+ 2008-09-17 02:49 . 2008-04-14 00:12 92160 c:\windows\system32\dllcache\evntwin.exe
+ 2008-09-17 02:49 . 2008-04-14 00:12 24064 c:\windows\system32\dllcache\evntcmd.exe
+ 2005-08-09 20:37 . 2009-08-07 00:24 96480 c:\windows\system32\dllcache\cdm.dll
- 2005-08-09 21:21 . 2009-10-29 14:52 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-08-09 21:21 . 2009-10-29 23:55 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-08-09 21:21 . 2009-10-29 14:52 32768 c:\windows\system32\config\systemprofile\Cookies\i ndex.dat
+ 2009-10-29 15:35 . 2009-10-29 23:55 32768 c:\windows\system32\config\systemprofile\Cookies\i ndex.dat
+ 2009-10-29 16:25 . 2009-10-29 16:25 49152 c:\windows\Installer\{49FA793C-785E-47E9-93DF-BD442B0B45D1}\Icon49FA793C.exe
+ 2009-10-29 17:36 . 2004-08-04 12:00 5632 c:\windows\system32\wbem\snmp\smimsgif.dll
+ 2009-10-29 17:36 . 2004-08-04 12:00 5632 c:\windows\system32\wbem\snmp\smierrsy.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 8704 c:\windows\system32\snmptrap.exe
+ 2008-09-17 02:50 . 2008-04-14 00:12 6144 c:\windows\system32\snmpmib.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 8704 c:\windows\system32\dllcache\snmptrap.exe
+ 2008-09-17 02:50 . 2008-04-14 00:12 6144 c:\windows\system32\dllcache\snmpmib.dll
+ 2009-10-29 16:41 . 2009-10-29 16:41 8854 c:\windows\Installer\{F05A5232-CE5E-4274-AB27-44EB8105898D}\ARPPRODUCTICON.exe
+ 2008-09-17 02:50 . 2008-04-14 00:12 188416 c:\windows\system32\wbem\snmpsmir.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 358400 c:\windows\system32\wbem\snmpincl.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 259072 c:\windows\system32\wbem\snmpcl.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 236544 c:\windows\system32\wbem\snmp\smi2smir.exe
+ 2005-08-09 20:38 . 2009-10-29 17:36 449324 c:\windows\system32\perfh009.dat
+ 2008-09-17 02:49 . 2008-04-14 00:11 101888 c:\windows\system32\evntagnt.dll
+ 2005-08-09 21:16 . 2009-08-07 00:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2005-08-09 21:16 . 2009-08-07 00:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2005-08-09 21:16 . 2009-08-07 00:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 188416 c:\windows\system32\dllcache\snmpsmir.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 358400 c:\windows\system32\dllcache\snmpincl.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 259072 c:\windows\system32\dllcache\snmpcl.dll
+ 2008-09-17 02:50 . 2008-04-14 00:12 236544 c:\windows\system32\dllcache\smi2smir.exe
+ 2008-09-17 02:49 . 2008-04-14 00:11 101888 c:\windows\system32\dllcache\evntagnt.dll
+ 2009-06-30 11:38 . 2009-10-29 23:55 245760 c:\windows\system32\config\systemprofile\IETldCach e\index.dat
- 2009-06-30 11:38 . 2009-10-29 14:52 245760 c:\windows\system32\config\systemprofile\IETldCach e\index.dat
+ 2005-08-09 21:16 . 2009-08-07 00:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2009-10-29 16:41 . 2009-10-29 16:41 1100800 c:\windows\Installer\205f20.msi
+ 2009-10-29 16:25 . 2009-10-29 16:25 1611776 c:\windows\Installer\1237b5.msi
+ 2009-10-29 16:40 . 2009-10-29 16:40 7873024 c:\windows\Downloaded Installations\{BF9A5F93-0556-477E-951D-21856805F9EB}\CA Pest Patrol Realtime Protection.msi
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\kb diamal]
@="{08BAD9B8-D926-C410-C5DE-9F4A5BDE3586}"
[HKEY_CLASSES_ROOT\CLSID\{08BAD9B8-D926-C410-C5DE-9F4A5BDE3586}]
2008-04-14 00:09 131072 ----a-w- c:\windows\system32\kbdiamal.ocx

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ComcastAntispyClient"="c:\program files\comcasttb\ComcastSpywareScan\ComcastAntispy. exe" [2009-08-19 1589208]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-29 344064]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 688218]
"Toshiba Hotkey Utility"="c:\program files\Toshiba\Windows Utilities\Hotkey.exe" [2005-10-18 1261568]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-09-07 1077301]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-18 151552]
"Notebook Maximizer"="c:\program files\Notebook Maximizer\maximizer_startup.exe" [2004-05-25 28672]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-09-17 645328]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"jiziyonube"="garepure.dll" [BU]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-29 53248]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2005-8-9 155648]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AntiVirus Plus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AntiVirus Plus.lnk
backup=c:\windows\pss\AntiVirus Plus.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Kathy^Start Menu^Programs^Startup^AntiVirus Plus.lnk]
path=c:\documents and settings\Kathy\Start Menu\Programs\Startup\AntiVirus Plus.lnk
backup=c:\windows\pss\AntiVirus Plus.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\ati2evxx.exe"=
"c:\\Program Files\\McAfee.com\\Agent\\mcagent.exe"=
"c:\\WINDOWS\\system32\\HPZipm12.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\dla\\tfswctrl.exe"=

R2 AntiSpywareService;Comcast AntiSpyware;c:\program files\comcasttb\ComcastSpywareScan\ComcastAntiSpyS ervice.exe [6/17/2009 12:49 PM 616408]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFH WATI.sys [3/31/2005 7:08 PM 211200]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - PCIIDEX_2
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
*Deregistered* - PCIIDEX_2
.
Contents of the 'Scheduled Tasks' folder

2009-07-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:34]

2009-09-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-04-01 17:22]

2009-10-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-04-01 17:22]

2009-10-29 c:\windows\Tasks\User_Feed_Synchronization-{783EECD9-4DD9-4414-A10A-6C5A99B4C8E4}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.micros oft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: microsoft.com\www.update
Trusted Zone: turbotax.com
.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-29 19:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2116426121-699555250-1234046695-1006\Software\Microsoft\SystemCertificates\Address Book*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(552)
c:\windows\system32\Ati2evxx.dll
c:\program files\CA\PPRT\bin\CACheck.dll
c:\program files\CA\PPRT\bin\CAHook.dll
c:\program files\CA\PPRT\bin\CAServer.dll

- - - - - - - > 'explorer.exe'(3924)
c:\windows\system32\WININET.dll
c:\program files\CA\PPRT\bin\CACheck.dll
c:\program files\CA\PPRT\bin\CAHook.dll
c:\program files\CA\PPRT\bin\CAServer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\Software Suite\PhotoImpression\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\system32\DVDRAMSV.exe
c:\program files\CA\PPRT\bin\ITMRTSVC.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\System32\snmp.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
************************************************** ************************
.
Completion time: 2009-10-30 19:26 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-30 00:26
ComboFix2.txt 2009-10-29 15:31

Pre-Run: 32,747,294,720 bytes free
Post-Run: 32,750,137,344 bytes free

- - End Of File - - C71D4E618CA37560E417D711A8DC8DEB