On May 13 at 5:00 AM CST, my computer was infected with a virus that I can't remove. I have several forms of protection but they have not corrected the issue with several attempts since. The most prevalent names are Darksma, Teslar A, Smitfraud - C.Core Service, Virtumonde. I have no idea what is necessary to remove the issues without reimaging my machine. The directions stated that a second txt file would appear after running DSS, but the below information for main.txt is the only thing that populated. Please help.

Deckard's System Scanner v20071014.68
Run by Joe Koch on 2008-06-09 21:16:02
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 504 MiB (512 MiB recommended).

-- HijackThis (run as Joe Koch.exe) --------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:11 PM, on 6/9/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\notepad.exe
C:\Documents and Settings\Joe Koch\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\JOEKOC~1.EXE
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ESPN: The Worldwide Leader In Sports
O2 - BHO: (no name) - {4C5D1FE7-1719-424D-993E-F7F208577098} - c:\windows\system32\atmfds.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {65D4EC0F-705B-44A4-BAAC-9ABBFD680ECE} - C:\WINDOWS\System32\iiffFuTk.dll
O2 - BHO: {b9311111-774c-9978-2db4-370cbe0b4586} - {6854b0eb-c073-4bd2-8799-c4771111139b} - C:\WINDOWS\System32\nwtcmomy.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: StFlex IE Helper - {847B6838-BFB6-40a1-8888-736928099059} - C:\Program Files\QdrDrive\QdrDrive15.dll (file missing)
O2 - BHO: gooochi browser optimizer - {a9102b7a-477d-f238-d7aa-4f335f09d15d} - C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll (file missing)
O2 - BHO: (no name) - {F9DF827A-8FA7-48A3-B268-CA4DB563EA40} - C:\WINDOWS\System32\byXPIayy.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [fwum2s] C:\WINDOWS\system32\fwum2s.exe
O4 - HKLM\..\Run: [{55b5cd8b-748d-bc0b-9d69-146d0cedb14d}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll" DllStart
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BM67f4596c] Rundll32.exe "C:\WINDOWS\System32\fjxktvws.dll",s
O4 - HKLM\..\Run: [64c76af0] rundll32.exe "C:\WINDOWS\System32\rnrfcmcy.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [fwum2s] C:\WINDOWS\system32\fwum2s.exe
O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe"
O4 - HKCU\..\Run: [Vcsron] C:\Program Files\Vcsron\Vcsron.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.onerateld.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - Kodakgallery.com Error Page
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - Kodakgallery.com Error Page
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - Winlogon Notify: byXPIayy - byXPIayy.dll (file missing)
O20 - Winlogon Notify: pzrqpnoz - C:\WINDOWS\SYSTEM32\atmfds.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
--
End of file - 8849 bytes
-- Files created between 2008-05-09 and 2008-06-09 -----------------------------
2008-06-09 20:45:56 91712 -----n--- C:\WINDOWS\System32\rnrfcmcy.dll
2008-06-09 20:44:29 100416 -----n--- C:\WINDOWS\System32\fjxktvws.dll
2008-06-05 13:22:44 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-06-05 10:36:18 0 d-------- C:\Program Files\Avira
2008-06-05 10:36:18 0 d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-06-05 09:15:16 0 d-------- C:\Program Files\Lavasoft
2008-06-05 09:15:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-05 09:14:09 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-05 05:31:54 0 d-------- C:\Program Files\Trend Micro
2008-06-04 21:30:26 0 d-------- C:\WINDOWS\CAVTemp
2008-06-04 04:36:58 0 d-------- C:\Program Files\Common Files\Mozilla Shared
2008-05-17 16:41:31 0 d-------- C:\CA
2008-05-14 05:07:32 0 d-------- C:\Program Files\Vcsron
2008-05-13 21:59:56 0 d-------- C:\WINDOWS\Prefetch
2008-05-13 21:28:34 0 d-------- C:\Program Files\Spcron
2008-05-13 21:26:33 0 d-------- C:\WINDOWS\System32\binR
2008-05-13 21:23:14 0 d-------- C:\Program Files\Temporary
2008-05-13 05:06:31 723439 --ahs---- C:\WINDOWS\System32\kTuFffii.ini2
2008-05-13 05:06:09 370176 --a------ C:\WINDOWS\System32\iiffFuTk.dll
2008-05-13 05:00:42 0 d-------- C:\WINDOWS\System32\dFrnx01
2008-05-13 05:00:42 0 d-------- C:\Temp

-- Find3M Report ---------------------------------------------------------------
2008-06-05 09:14:09 0 d-------- C:\Program Files\Common Files

-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C5D1FE7-1719-424D-993E-F7F208577098}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{65D4EC0F-705B-44A4-BAAC-9ABBFD680ECE}]
05/13/2008 05:06 AM 370176 --a------ C:\WINDOWS\System32\iiffFuTk.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6854b0eb-c073-4bd2-8799-c4771111139b}]
C:\WINDOWS\System32\nwtcmomy.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{847B6838-BFB6-40a1-8888-736928099059}]
C:\Program Files\QdrDrive\QdrDrive15.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a9102b7a-477d-f238-d7aa-4f335f09d15d}]
C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9DF827A-8FA7-48A3-B268-CA4DB563EA40}]
C:\WINDOWS\System32\byXPIayy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [12/15/2005 11:18 AM]
"Camera Detector"="C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1. exe" [06/17/2003 02:43 PM]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [05/05/2003 08:57 AM]
"DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [05/08/2003 12:34 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [07/12/2007 04:00 AM]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [08/28/2007 03:07 AM]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [06/12/2007 12:32 PM]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [09/25/2004 01:37 AM]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM]
"QOELOADER"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [08/28/2007 03:07 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [11/15/2007 12:43 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [11/15/2007 02:11 PM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
"fwum2s"="C:\WINDOWS\system32\fwum2s.exe" []
"{55b5cd8b-748d-bc0b-9d69-146d0cedb14d}"="C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll" []
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [02/12/2008 10:06 AM]
"BM67f4596c"="C:\WINDOWS\System32\fjxktvws.dll " [06/09/2008 08:45 PM]
"64c76af0"="C:\WINDOWS\System32\rnrfcmcy.dll" [06/09/2008 08:45 PM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/02/2001 07:14 AM]
"WinUpdater"="" []
"WebSUpdater"="" []
"fwum2s"="C:\WINDOWS\system32\fwum2s.exe" []
"QdrPack15"="C:\Program Files\QdrPack\QdrPack15.exe" []
"Vcsron"="C:\Program Files\Vcsron\Vcsron.exe" []
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [12/15/2005 11:40:44 AM]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [12/15/2005 1:00:54 PM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 3:05:56 PM]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer]
"ForceActiveDesktopOn"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks]
"{F9DF827A-8FA7-48A3-B268-CA4DB563EA40}"= C:\WINDOWS\System32\byXPIayy.dll [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXPIayy]
byXPIayy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pzrqpnoz]
atmfds.dll 08/23/2001 07:00 AM 84480 C:\WINDOWS\system32\atmfds.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\System32\iiffFuTk
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\aawservice]
@="Service"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
yotowukf


-- End of Deckard's System Scanner: finished at 2008-06-09 21:17:07 ------------

You are in the wrong forum.I will move you out...in the mean time...

As you are not running Service Pack 2 yet and we will need it later please save and run the download.It will copy the results to your clipboard. Will you copy and paste them back here please.
http://go.microsoft.com/fwlink/?linkid=52012

=============================

Please download SDFix from here and save it to your desktop
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Please copy and paste that log in your next reply.

Mr. Pancake,

Thank you for your help. I followed your instructions and the information you need is posted below.

Diagnostic Report (1.7.0095.0):
-----------------------------------------
WGA Data-->
Validation Status: Genuine
Validation Code: 0
Online Validation Code: N/A
Cached Validation Code: N/A
Windows Product Key: *****-*****-8CHR8-27H4P-Y2KFY
Windows Product Key Hash: rAFZtFfaBsy51n/xJpTsokJSIn8=
Windows Product ID: 55274-007-5415166-22175
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 5.1.2600.2.00010100.0.0.pro
CSVLK Server: N/A
CSVLK PID: N/A
ID: {FBA3D6AB-04C6-4B21-A884-C2A92B51C0C6}(3)
Is Admin: Yes
TestCab: 0x0
WGA Version: Registered, 1.7.36.0
Signed By: Microsoft
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-171-1
Resolution Status: N/A
WgaER Data-->
ThreatID(s): N/A
Version: N/A
WGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
WGATray.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-171-1
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control:
Active scripting:
Script ActiveX controls marked as safe for scripting:
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{FBA3D6AB-04C6-4B21-A884-C2A92B51C0C6}</UGUID><Version>1.7.0095.0</Version><OS>5.1.2600.2.00010100.0.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-Y2KFY</PKey><PID>55274-007-5415166-22175</PID><PIDType>5</PIDType><SID>S-1-5-21-117609710-1417001333-839522115</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Workstation xw3100</Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>786B2 v1.11</Version><SMBIOSVersion major="2" minor="3"/><Date>20030710******.******+***</Date></BIOS><HWID>ACC7330701848053</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><BRT/></MachineData> <Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>






SDFix: Version 1.192
Run by Joe Koch on Sat 06/14/2008 at 06:23 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Checking Services :

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting

Checking Files :
No Trojan Files Found


Folder C:\Program Files\Spcron - Removed
Folder C:\Program Files\Temporary - Removed
Folder C:\Temp\tn3 - Removed
Folder C:\WINDOWS\system32\dFrnx01 - Removed

Removing Temp Files
ADS Check :


Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-14 18:35:11
Windows 5.1.2600 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :


Authorized Application Key Export:
Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :

Finished!

Ok.Lets download ComboFix.exe. This will give me a better view to the files running and also hidden on your computer and also those in the registry..Please visit this webpage for download links, and instructions for running the tool:
A guide and tutorial on using ComboFix

Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use SP2
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should get a prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
(1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
(2) Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New HijackThis log.
Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Mal use can cause serious computer problems
NOTE: Combofix prevents autorun of all CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.

Pancake, the combo fix log and the new hijack this log are posted below. Something has been corrected on my computer all ready because it is running better, but I have no idea what. It is still not 100% however.

ComboFix 08-06-15.2 - Joe Koch 2008-06-16 7:36:02.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.220 [GMT -5:00]
Running from: C:\Documents and Settings\Joe Koch\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Joe Koch\Desktop\WinXP_EN_PRO_BF.EXE
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Joe Koch\Local Settings\Temporary Internet Files\bestwiner.stt
C:\Documents and Settings\Joe Koch\Local Settings\Temporary Internet Files\CPV.stt
C:\WINDOWS\system32\atmfds.dll . . . . failed to delete
.
((((((((((((((((((((((((( Files Created from 2008-05-16 to 2008-06-16 )))))))))))))))))))))))))))))))
.
2008-06-14 18:30 . 2008-06-14 18:30 2,572 --a------ C:\WINDOWS\system32\PerfStringBackup.TMP
2008-06-14 18:21 . 2008-06-14 18:21 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-14 17:29 . 2008-06-14 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-06-07 08:42 . 2008-06-07 08:42 50,004 --ahs---- C:\WINDOWS\system32\hyaxoxvu.ini
2008-06-05 20:09 . 2008-06-07 08:33 49,944 --ahs---- C:\WINDOWS\system32\hutpdwbc.ini
2008-06-05 10:36 . 2008-06-05 10:36 <DIR> d-------- C:\Program Files\Avira
2008-06-05 10:36 . 2008-06-05 10:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-06-05 09:15 . 2008-06-05 09:15 <DIR> d-------- C:\Program Files\Lavasoft
2008-06-05 09:15 . 2008-06-05 09:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-05 09:14 . 2008-06-05 09:14 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-05 06:46 . 2008-06-05 06:46 <DIR> d-------- C:\Deckard
2008-06-05 05:31 . 2008-06-05 05:31 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-04 21:30 . 2008-06-14 10:14 <DIR> d-------- C:\WINDOWS\CAVTemp
2008-06-04 13:01 . 2008-06-04 13:01 880,560 --a------ C:\WINDOWS\system32\drivers\vetefile.sys
2008-06-04 13:01 . 2008-06-04 13:01 108,368 --a------ C:\WINDOWS\system32\drivers\veteboot.sys
2008-06-04 04:36 . 2008-06-15 02:48 <DIR> d-------- C:\Program Files\Common Files\Mozilla Shared
2008-06-04 04:35 . 2008-06-16 07:43 12,980 --a------ C:\WINDOWS\system32\wpa.dbl
2008-05-30 13:33 . 2008-05-30 13:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-30 13:33 . 2008-05-30 13:33 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-17 16:41 . 2008-05-17 16:41 <DIR> d-------- C:\CA
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-06-16 12:40 84,992 ----a-w C:\WINDOWS\system32\eairwi.dll
2008-06-04 09:57 --------- d-----w C:\Program Files\Vcsron
2008-05-16 01:07 196,608 ----a-w C:\WINDOWS\system32\libssl32.dll
2008-05-16 01:07 1,015,808 ----a-w C:\WINDOWS\system32\libeay32.dll
2008-04-29 16:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 16:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 16:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2007-08-09 23:54 3,378,808 ----a-w C:\Program Files\LimeWireWin.exe
.
((((((((((((((((((((((((((((( snapshot@2008-06-15_18.37.09.46 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-15 23:31:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-16 12:43:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-06-15 23:34:08 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\i ndex.dat
+ 2008-06-16 12:43:16 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\i ndex.dat
- 2008-06-15 23:34:08 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-16 12:43:16 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-15 23:34:08 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-16 12:43:16 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{493a6b84-315a-4e24-9781-093453ecf3d3}]
C:\WINDOWS\System32\bybmsjrc.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C5D1FE7-1719-424D-993E-F7F208577098}]
2008-06-16 07:40 84992 --a------ c:\windows\system32\atmfds.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A72DB6CA-70CB-4C4B-99FF-A6016E8BD694}]
C:\WINDOWS\System32\iiffFuTk.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a9102b7a-477d-f238-d7aa-4f335f09d15d}]
C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"fwum2s"="C:\WINDOWS\system32\fwum2s.exe" [ ]
"Vcsron"="C:\Program Files\Vcsron\Vcsron.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 11:18 49152]
"Camera Detector"="C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1. exe" [2003-06-17 14:43 208896]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 08:57 143360]
"DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 12:34 69632]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-28 03:07 177416]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-06-12 12:32 230928]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-09-25 01:37 1691648]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"QOELOADER"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [2007-08-28 03:07 14088]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-11-15 00:43 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 14:11 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"fwum2s"="C:\WINDOWS\system32\fwum2s.exe" [ ]
"{55b5cd8b-748d-bc0b-9d69-146d0cedb14d}"="C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll" [ ]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"BM67f4596c"="C:\WINDOWS\System32\fjxktvws.dll " [ ]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 11:40:44 282624]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-12-15 13:00:54 73728]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pzrqpnoz]
atmfds.dll 2008-06-16 07:40 84992 C:\WINDOWS\system32\atmfds.dll
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgn tmgr.sys [2008-01-21 18:11]
R0 vggvgylo;vggvgylo;C:\WINDOWS\System32\drivers\vggv gylo.sys [2001-08-23 07:00]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntd d.sys [2008-01-21 18:12]
R3 PPCtlPriv;PPCtlPriv;"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2007-08-28 03:07]
S1 audstubb;audstubb;C:\WINDOWS\System32\drivers\auds tubb.sys []
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
yotowukf
.
Contents of the 'Scheduled Tasks' folder
"2008-05-16 17:40:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-08 03:44:40 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as Joe Koch at 10 44 PM.job"
- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe
.
************************************************** ************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-16 07:44:30
Windows 5.1.2600 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
.
************************************************** ************************
.
Completion time: 2008-06-16 7:48:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-16 12:48:16
ComboFix2.txt 2008-06-15 23:38:01
Pre-Run: 33,757,687,808 bytes free
Post-Run: 33,730,469,888 bytes free
WinXP_EN_PRO_BF.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
155





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:31 AM, on 6/16/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ESPN: The Worldwide Leader In Sports
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
O2 - BHO: {3d3fce35-4390-1879-42e4-a51348b6a394} - {493a6b84-315a-4e24-9781-093453ecf3d3} - C:\WINDOWS\System32\bybmsjrc.dll (file missing)
O2 - BHO: (no name) - {4C5D1FE7-1719-424D-993E-F7F208577098} - c:\windows\system32\atmfds.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {A72DB6CA-70CB-4C4B-99FF-A6016E8BD694} - C:\WINDOWS\System32\iiffFuTk.dll (file missing)
O2 - BHO: gooochi browser optimizer - {a9102b7a-477d-f238-d7aa-4f335f09d15d} - C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [fwum2s] C:\WINDOWS\system32\fwum2s.exe
O4 - HKLM\..\Run: [{55b5cd8b-748d-bc0b-9d69-146d0cedb14d}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll" DllStart
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BM67f4596c] Rundll32.exe "C:\WINDOWS\System32\fjxktvws.dll",s
O4 - HKCU\..\Run: [fwum2s] C:\WINDOWS\system32\fwum2s.exe
O4 - HKCU\..\Run: [Vcsron] C:\Program Files\Vcsron\Vcsron.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.onerateld.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - Kodakgallery.com Error Page
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - Kodakgallery.com Error Page
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - Winlogon Notify: pzrqpnoz - C:\WINDOWS\SYSTEM32\atmfds.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
--
End of file - 8400 bytes

This should be the last of the cleaning..

Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.

O2 - BHO: {3d3fce35-4390-1879-42e4-a51348b6a394} - {493a6b84-315a-4e24-9781-093453ecf3d3} - C:\WINDOWS\System32\bybmsjrc.dll (file missing)
O2 - BHO: (no name) - {4C5D1FE7-1719-424D-993E-F7F208577098} - c:\windows\system32\atmfds.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A72DB6CA-70CB-4C4B-99FF-A6016E8BD694} - C:\WINDOWS\System32\iiffFuTk.dll (file missing)
O2 - BHO: gooochi browser optimizer - {a9102b7a-477d-f238-d7aa-4f335f09d15d} - C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll (file missing)
O4 - HKLM\..\Run: [fwum2s] C:\WINDOWS\system32\fwum2s.exe
O4 - HKLM\..\Run: [{55b5cd8b-748d-bc0b-9d69-146d0cedb14d}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\System32\{7c684bc4-2af9-ae6e-d12f-9bdb471cdc0e}.dll" DllStart
O4 - HKLM\..\Run: [BM67f4596c] Rundll32.exe "C:\WINDOWS\System32\fjxktvws.dll",s
O4 - HKCU\..\Run: [fwum2s] C:\WINDOWS\system32\fwum2s.exe
O4 - HKCU\..\Run: [Vcsron] C:\Program Files\Vcsron\Vcsron.exe
O20 - Winlogon Notify: pzrqpnoz - C:\WINDOWS\SYSTEM32\atmfds.dll

Reboot....................

==============================


Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open *notepad* and copy/paste the text in the quotebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt
Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*

Pancake here is the latest information you requested. I can't tell you how much I appreciate your help.

ComboFix 08-06-15.2 - Joe Koch 2008-06-16 21:36:06.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.315 [GMT -5:00]
Running from: C:\Documents and Settings\Joe Koch\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Joe Koch\Desktop\CFScript..txt
* Created a new restore point
FILE ::
c:\windows\system32\atmfds.dll
C:\WINDOWS\system32\eairwi.dll
C:\WINDOWS\system32\hutpdwbc.ini
C:\WINDOWS\system32\hyaxoxvu.ini
.
((((((((((((((((((