Hello TechSpot,
I'm at a family members for the holidays and there having an issue with there web browser/ Google redirecting them to malicious sites. From what Ive see in other thread's, this is a widespread problem.

Ive went through the 8-step process and here are my logs:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5378

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

12/22/2010 1:59:57 PM
mbam-log-2010-12-22 (13-59-57).txt

Scan type: Quick scan
Objects scanned: 125112
Time elapsed: 5 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 6
Files Infected: 16

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Privacy Tools (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Trojan.Agent) -> Value: Shell -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
c:\documents and settings\LonnyM\application data\PC\faq (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\local settings\application data\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\local settings\application data\DoubleD\juicyaccess toolbar (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\local settings\application data\DoubleD\juicyaccess toolbar\4.1.0.17730 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\local settings\application data\DoubleD\juicyaccess toolbar\4.1.0.17730\bin (Adware.DoubleD) -> Quarantined and deleted successfully.

Files Infected:
c:\documents and settings\LonnyM\application data\dsfsds.bat (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\settings.ini (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\uninstall.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\sdfsfs.bat (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\srsf.bat (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\guide.html (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg1.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg10.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg2.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg3.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg4.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg5.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg6.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg7.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg8.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
c:\documents and settings\LonnyM\application data\PC\faq\images\gimg9.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-12-22 14:17:09
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 Maxtor_2F040L0 rev.VAM51JJ0
Running: 4umf5hup.exe; Driver: C:\DOCUME~1\LonnyM\LOCALS~1\Temp\fxtdapog.sys



---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sectors 80292992 (+254): rootkit-like behavior;

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T1L0-17 8A20AAEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8A20AAEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8A20AAEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-f 8A20AAEA
Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskMaxtor_2F040L0__________________________VAM51JJ0#3146483433534538202020202020202020202020#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- EOF - GMER 1.0.15 ----



DDS (Ver_10-12-12.02) - NTFSx86
Run by LonnyM at 14:20:40.93 on Wed 12/22/2010
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1064 [GMT -5:00]

AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\system32\Promon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe
C:\WINDOWS\system32\mgabg.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\LonnyM\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
mRun: [Promon.exe] Promon.exe
mRun: [SprintModemUpdate] javaw.exe -cp "c:\program files\motive\firmwareupdater\lib\SprintModemUpdate.jar" com.motive.firmwareUpdater.client.SprintModemUpdate
mRun: [BJCFD] c:\program files\broadjump\client foundation\CFD.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [lxcrmon.exe] "c:\program files\lexmark 2400 series\lxcrmon.exe"
mRun: [EzPrint] "c:\program files\lexmark 2400 series\ezprint.exe"
mRun: [FaxCenterServer] "c:\program files\lexmark fax solutions\fm3032.exe" /s
mRun: [LXCRCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCRtime.dll,_RunDLLEntry@16
mRun: [REGSHAVE] c:\program files\regshave\REGSHAVE.EXE /AUTORUN
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Matrox PowerDesk SE] "c:\program files\matrox graphics inc\powerdesk se\Matrox.PowerDesk SE.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewer\QuickDCF.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: avgrsstarter - avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\lonnym\applic~1\mozilla\firefox\profiles\lbatd972.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava11.dll
FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava12.dll
FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava13.dll
FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava14.dll
FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava32.dll
FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJPI142_05.dll
FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPOJI610.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-9-21 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-9-21 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-9-21 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-9-21 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-9-21 297752]
R2 Matrox Centering Service;Matrox Centering Service;c:\program files\matrox graphics inc\powerdesk\services\Matrox.PowerDesk.Services.exe [2009-2-6 1263872]
R2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;c:\program files\matrox graphics inc\powerdesk se\Matrox.Pdesk.ServicesHost.exe [2009-2-6 344832]

=============== Created Last 30 ================

2010-12-22 18:48:32 -------- d-----w- c:\docume~1\lonnym\applic~1\Malwarebytes
2010-12-22 18:48:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-22 18:48:25 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-12-22 18:48:21 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-22 18:48:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-22 15:55:47 -------- d-----w- c:\program files\VideoLAN
2010-12-21 21:03:58 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2010-12-21 21:03:58 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-12-21 16:43:19 -------- d-----w- c:\program files\common files\DivX Shared
2010-12-21 01:49:22 -------- d-----w- c:\docume~1\lonnym\applic~1\Local
2010-12-21 01:41:58 -------- d-----w- c:\program files\DivX
2010-12-21 01:41:17 -------- d-----w- c:\docume~1\alluse~1\applic~1\DivX
2010-12-20 13:52:49 -------- d-----w- c:\docume~1\lonnym\locals~1\applic~1\Opera
2010-12-20 04:44:38 -------- d-----w- c:\docume~1\lonnym\applic~1\Panda Security
2010-12-20 04:32:26 -------- d-----w- c:\docume~1\alluse~1\applic~1\Panda Security

==================== Find3M ====================


=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: Maxtor_2F040L0 rev.VAM51JJ0 -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A20AEC5]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x8a202872; SUB DWORD [EBP-0x4], 0x8a20212e; PUSH EDI; CALL 0xffffffffffffdf33; }
1 nt!IofCallDriver[0x804E37C5] -> \Device\Harddisk0\DR0[0x8A204AB8]
3 CLASSPNP[0xF7647FD7] -> nt!IofCallDriver[0x804E37C5] -> \Device\00000051[0x8A29DF18]
5 ACPI[0xF750E620] -> nt!IofCallDriver[0x804E37C5] -> [0x8A29A940]
[0x8A1CCD98] -> IRP_MJ_CREATE -> 0x8A20AEC5
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskMaxtor_2F040L0__________________________VAM51JJ0#3146483433534538202020202020202020202020#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A20AAEA
user & kernel MBR OK
sectors 80293246 (+255): user != kernel
Warning: possible TDL3 rootkit infection !

============= FINISH: 14:22:13.54 ===============




UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 6/29/2009 10:38:55 PM
System Uptime: 12/22/2010 2:01:12 PM (0 hours ago)

Motherboard: Intel Corporation | | D845WN
Processor: Intel(R) Pentium(R) 4 CPU 1600MHz | J2E1 | 1594/100mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 38 GiB total, 22.986 GiB free.
D: is CDROM ()
E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: Microsoft PS/2 Port Mouse (IntelliPoint)
Device ID: ACPI\PNP0F03\4&163C0F35&0
Manufacturer: Microsoft
Name: Microsoft PS/2 Port Mouse (IntelliPoint)
PNP Device ID: ACPI\PNP0F03\4&163C0F35&0
Service: i8042prt

Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Device ID: ACPI\PNP0303\4&163C0F35&0
Manufacturer: (Standard keyboards)
Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&163C0F35&0
Service: i8042prt

==== System Restore Points ===================

RP138: 9/28/2010 9:32:03 PM - System Checkpoint
RP139: 10/7/2010 8:35:01 PM - Avg8 Update
RP140: 10/9/2010 9:45:37 AM - System Checkpoint
RP141: 10/10/2010 2:56:04 PM - System Checkpoint
RP142: 10/17/2010 5:24:17 PM - System Checkpoint
RP143: 10/26/2010 8:09:58 PM - Avg8 Update
RP144: 10/26/2010 8:11:14 PM - Avg8 Update
RP145: 12/5/2010 9:42:07 AM - System Checkpoint
RP146: 12/11/2010 12:14:21 PM - System Checkpoint
RP147: 12/14/2010 9:47:22 PM - System Checkpoint
RP148: 12/17/2010 12:11:34 AM - System Checkpoint
RP149: 12/18/2010 1:57:04 AM - System Checkpoint
RP150: 12/19/2010 12:04:47 PM - System Checkpoint
RP151: 12/20/2010 12:12:30 PM - System Checkpoint
RP152: 12/21/2010 12:25:14 PM - System Checkpoint

==== Installed Programs ======================

ABBYY FineReader 6.0 Sprint
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AVG Free 8.5
Bonjour
BroadJump Client Foundation
CCleaner (remove only)
DivX Web Player
FinePixViewer Ver.3.2
FUJIFILM USB Driver
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
ImageMixer VCD for FinePix
Intel(R) Network Connections Drivers
iTunes
Java 2 Runtime Environment, SE v1.4.2_05
Lexmark 2400 Series
Lexmark Fax Solutions
Lexmark Toolbar
Malwarebytes' Anti-Malware
Matrox Graphics Software (remove only)
Matrox PowerDesk-SE
Microsoft Application Error Reporting
Microsoft IntelliPoint 6.3
Microsoft IntelliType Pro 6.3
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Visual C++ 2005 Redistributable
MicroStaff WINASPI
Mozilla Firefox (3.5.16)
MSN
MSXML 4.0 SP2 (KB954430)
Opera 11.00
QuickTime
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
VLC media player 1.1.5
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)

==== Event Viewer Messages From Past Week ========

12/22/2010 2:15:59 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
12/22/2010 2:02:20 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
12/22/2010 1:36:21 PM, error: Service Control Manager [7034] - The lxcr_device service terminated unexpectedly. It has done this 1 time(s).
12/22/2010 1:36:21 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
12/22/2010 1:36:21 PM, error: Service Control Manager [7034] - The AVG Free8 E-mail Scanner service terminated unexpectedly. It has done this 1 time(s).
12/22/2010 1:36:20 PM, error: Service Control Manager [7034] - The MGABGEXE service terminated unexpectedly. It has done this 1 time(s).
12/22/2010 1:36:20 PM, error: Service Control Manager [7034] - The Matrox.Pdesk.ServicesHost service terminated unexpectedly. It has done this 1 time(s).
12/22/2010 1:36:20 PM, error: Service Control Manager [7034] - The Matrox Centering Service service terminated unexpectedly. It has done this 1 time(s).
12/22/2010 1:36:20 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
12/22/2010 1:36:20 PM, error: Service Control Manager [7031] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
12/22/2010 1:36:20 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/22/2010 1:13:28 PM, error: Service Control Manager [7034] - The Panda Cloud Antivirus Service service terminated unexpectedly. It has done this 1 time(s).
12/21/2010 7:46:32 PM, error: Dhcp [1002] - The IP address lease 70.119.59.138 for the Network Card with network address 000347CAAAA8 has been denied by the DHCP server 192.168.0.10 (The DHCP Server sent a DHCPNACK message).
12/17/2010 4:45:00 PM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{D8986604-8B57-4778-B41E-1C9309DA4E8B} because another computer on the network has the same name. The server could not start.
12/17/2010 4:31:16 PM, error: Dhcp [1002] - The IP address lease 68.207.121.165 for the Network Card with network address 000347CAAAA8 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
12/16/2010 11:34:17 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
12/16/2010 11:33:35 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
12/16/2010 11:33:35 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.

==== End Of File ===========================

Ran TDSSKiller, found 1 infected file. Continued with the cure process, rebooted.
Here is the log file:

2010/12/22 15:35:51.0890 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
2010/12/22 15:35:51.0890 ================================================================================
2010/12/22 15:35:51.0890 SystemInfo:
2010/12/22 15:35:51.0890
2010/12/22 15:35:51.0890 OS Version: 5.1.2600 ServicePack: 3.0
2010/12/22 15:35:51.0890 Product type: Workstation
2010/12/22 15:35:51.0890 ComputerName: LONNY
2010/12/22 15:35:51.0890 UserName: LonnyM
2010/12/22 15:35:51.0890 Windows directory: C:\WINDOWS
2010/12/22 15:35:51.0890 System windows directory: C:\WINDOWS
2010/12/22 15:35:51.0890 Processor architecture: Intel x86
2010/12/22 15:35:51.0890 Number of processors: 1
2010/12/22 15:35:51.0890 Page size: 0x1000
2010/12/22 15:35:51.0890 Boot type: Normal boot
2010/12/22 15:35:51.0890 ================================================================================
2010/12/22 15:35:52.0546 Initialize success
2010/12/22 15:36:07.0296 ================================================================================
2010/12/22 15:36:07.0296 Scan started
2010/12/22 15:36:07.0296 Mode: Manual;
2010/12/22 15:36:07.0296 ================================================================================
2010/12/22 15:36:15.0000 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
2010/12/22 15:36:15.0265 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/12/22 15:36:15.0484 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/12/22 15:36:15.0750 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/12/22 15:36:15.0906 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2010/12/22 15:36:16.0078 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2010/12/22 15:36:16.0906 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/12/22 15:36:17.0078 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/12/22 15:36:17.0453 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/12/22 15:36:17.0656 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/12/22 15:36:17.0890 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
2010/12/22 15:36:18.0125 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
2010/12/22 15:36:18.0250 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
2010/12/22 15:36:18.0406 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/12/22 15:36:18.0671 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/12/22 15:36:19.0140 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/12/22 15:36:19.0593 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/12/22 15:36:19.0984 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/12/22 15:36:20.0531 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/12/22 15:36:21.0171 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2010/12/22 15:36:21.0562 dmio (d8df502ded3fff583f6483ffa521aadd) C:\WINDOWS\system32\drivers\dmio.sys
2010/12/22 15:36:21.0562 Suspicious file (Forged): C:\WINDOWS\system32\drivers\dmio.sys. Real md5: d8df502ded3fff583f6483ffa521aadd, Fake md5: 7c824cf7bbde77d95c08005717a95f6f
2010/12/22 15:36:21.0593 dmio - detected Rootkit.Win32.TDSS.tdl3 (0)
2010/12/22 15:36:21.0734 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/12/22 15:36:21.0921 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/12/22 15:36:22.0250 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/12/22 15:36:22.0375 E100B (ac9cf17ee2ae003c98eb4f5336c38058) C:\WINDOWS\system32\DRIVERS\e100b325.sys
2010/12/22 15:36:22.0625 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/12/22 15:36:22.0734 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2010/12/22 15:36:22.0843 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2010/12/22 15:36:22.0953 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/12/22 15:36:23.0156 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2010/12/22 15:36:23.0406 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/12/22 15:36:23.0625 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/12/22 15:36:23.0859 G400 (36feb2ddce5f84128c2a8dbc60538dad) C:\WINDOWS\system32\DRIVERS\G400m.sys
2010/12/22 15:36:24.0078 G400DH (2dd3d27e36ebf6804c40b843ff10872f) C:\WINDOWS\system32\DRIVERS\g400dhm.sys
2010/12/22 15:36:24.0312 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2010/12/22 15:36:24.0515 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/12/22 15:36:24.0734 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/12/22 15:36:25.0000 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/12/22 15:36:25.0375 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/12/22 15:36:26.0000 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/12/22 15:36:26.0390 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2010/12/22 15:36:26.0531 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2010/12/22 15:36:26.0671 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/12/22 15:36:26.0828 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/12/22 15:36:26.0953 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/12/22 15:36:27.0125 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/12/22 15:36:27.0265 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/12/22 15:36:27.0453 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/12/22 15:36:27.0578 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/12/22 15:36:27.0687 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/12/22 15:36:27.0828 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/12/22 15:36:27.0953 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/12/22 15:36:28.0390 MASPINT (a2ae666cee860babe7fa6f1662b71737) C:\WINDOWS\system32\drivers\MASPINT.sys
2010/12/22 15:36:28.0609 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/12/22 15:36:28.0765 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2010/12/22 15:36:28.0937 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/12/22 15:36:29.0062 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/12/22 15:36:29.0609 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/12/22 15:36:29.0921 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/12/22 15:36:30.0062 MRxSmb (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/12/22 15:36:30.0265 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/12/22 15:36:30.0406 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/12/22 15:36:30.0500 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/12/22 15:36:30.0593 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/12/22 15:36:30.0750 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/12/22 15:36:30.0859 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/12/22 15:36:30.0968 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2010/12/22 15:36:31.0109 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/12/22 15:36:31.0187 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/12/22 15:36:31.0250 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/12/22 15:36:31.0359 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/12/22 15:36:31.0437 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/12/22 15:36:31.0531 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/12/22 15:36:31.0703 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/12/22 15:36:32.0218 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/12/22 15:36:32.0578 NuidFltr (cf7e041663119e09d2e118521ada9300) C:\WINDOWS\system32\DRIVERS\NuidFltr.sys
2010/12/22 15:36:32.0812 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/12/22 15:36:33.0140 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/12/22 15:36:33.0484 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/12/22 15:36:33.0921 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/12/22 15:36:34.0593 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/12/22 15:36:34.0953 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/12/22 15:36:35.0328 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/12/22 15:36:35.0953 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/12/22 15:36:36.0718 Point32 (cf7c1868b90c90a265fc3f60ce46265b) C:\WINDOWS\system32\DRIVERS\point32.sys
2010/12/22 15:36:36.0921 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/12/22 15:36:37.0062 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2010/12/22 15:36:37.0203 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/12/22 15:36:37.0312 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/12/22 15:36:37.0843 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/12/22 15:36:37.0984 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/12/22 15:36:38.0125 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/12/22 15:36:38.0265 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/12/22 15:36:38.0437 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/12/22 15:36:38.0640 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/12/22 15:36:38.0859 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/12/22 15:36:39.0078 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/12/22 15:36:39.0234 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/12/22 15:36:39.0562 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/12/22 15:36:39.0718 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/12/22 15:36:39.0828 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/12/22 15:36:39.0968 sermouse (1f16931c722c69e4a7866244796c66a0) C:\WINDOWS\system32\DRIVERS\sermouse.sys
2010/12/22 15:36:40.0140 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/12/22 15:36:40.0390 smwdm (21c6c6aeb3dd2836b0e21c599d8cd437) C:\WINDOWS\system32\drivers\smwdm.sys
2010/12/22 15:36:40.0734 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/12/22 15:36:40.0921 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/12/22 15:36:41.0125 Srv (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/12/22 15:36:41.0328 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/12/22 15:36:41.0468 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/12/22 15:36:41.0921 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/12/22 15:36:42.0171 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/12/22 15:36:42.0421 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/12/22 15:36:42.0578 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/12/22 15:36:42.0750 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/12/22 15:36:43.0109 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/12/22 15:36:43.0359 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/12/22 15:36:43.0593 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\WINDOWS\system32\Drivers\usbaapl.sys
2010/12/22 15:36:43.0765 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/12/22 15:36:43.0937 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/12/22 15:36:44.0109 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/12/22 15:36:44.0296 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/12/22 15:36:44.0406 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/12/22 15:36:44.0578 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/12/22 15:36:44.0703 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/12/22 15:36:44.0937 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/12/22 15:36:45.0125 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/12/22 15:36:45.0281 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
2010/12/22 15:36:45.0609 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/12/22 15:36:46.0234 ================================================================================
2010/12/22 15:36:46.0234 Scan finished
2010/12/22 15:36:46.0234 ================================================================================
2010/12/22 15:36:46.0296 Detected object count: 1
2010/12/22 15:37:03.0453 dmio (d8df502ded3fff583f6483ffa521aadd) C:\WINDOWS\system32\drivers\dmio.sys
2010/12/22 15:37:03.0468 Suspicious file (Forged): C:\WINDOWS\system32\drivers\dmio.sys. Real md5: d8df502ded3fff583f6483ffa521aadd, Fake md5: 7c824cf7bbde77d95c08005717a95f6f
2010/12/22 15:37:05.0796 Backup copy found, using it..
2010/12/22 15:37:05.0812 C:\WINDOWS\system32\drivers\dmio.sys - will be cured after reboot
2010/12/22 15:37:05.0812 Rootkit.Win32.TDSS.tdl3(dmio) - User select action: Cure
2010/12/22 15:37:23.0187 Deinitialize success

Ive run into a little trouble with AVG and Combofix. I downloaded appremover as advised, ran the exe. and removed AVG. When i run Combofix, i receive a message saying AVG is still on the computer and Combofix will not run. I ran appremover, in both modes and AVG does not show up on the list.

Safe mode was the solution.
The computer currently has no anti-virus software, Should i wait till the end of this to install one?

Here are the logs from MBRCheck and Combofix:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 122):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF75C4000 klmdb.sys
0xF7596000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7585000 pci.sys
0xF75F7000 isapnp.sys
0xF798B000 intelide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7607000 MountMgr.sys
0xF74C6000 ftdisk.sys
0xF798D000 dmload.sys
0xF74A0000 tskBE.tmp
0xF770F000 PartMgr.sys
0xF7617000 VolSnap.sys
0xF7488000 atapi.sys
0xF7627000 disk.sys
0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7468000 fltMgr.sys
0xF7456000 sr.sys
0xF743F000 KSecDD.sys
0xF7B52000 Ntfs.sys
0xF7412000 NDIS.sys
0xF787D000 Mup.sys
0xF7647000 agp440.sys
0xBAF98000 \SystemRoot\system32\DRIVERS\processr.sys
0xBA40E000 \SystemRoot\system32\DRIVERS\g400dhm.sys
0xBA3FA000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA3D3000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xBAF88000 \SystemRoot\system32\DRIVERS\serial.sys
0xF776F000 \SystemRoot\System32\Drivers\Modem.SYS
0xF777F000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7787000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF778F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF792F000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA3BF000 \SystemRoot\system32\DRIVERS\parport.sys
0xBAF68000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBAF58000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA39C000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7797000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xBAF48000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF779F000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA378000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA312000 \SystemRoot\system32\drivers\smwdm.sys
0xF7A6B000 \SystemRoot\system32\drivers\SENSUPGD.SYS
0xBA2EE000 \SystemRoot\system32\drivers\portcls.sys
0xBAF38000 \SystemRoot\system32\drivers\drmk.sys
0xF7A6F000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7677000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF793B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xBA277000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7687000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7697000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF77A7000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xBA1C6000 \SystemRoot\system32\DRIVERS\psched.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF77B7000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF77BF000 \SystemRoot\system32\DRIVERS\raspti.sys
0xBA0FD000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF799F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xBA09F000 \SystemRoot\system32\DRIVERS\update.sys
0xBAFF4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF76C7000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF77CF000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79BB000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF79BD000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA154000 \SystemRoot\System32\Drivers\Null.SYS
0xF79BF000 \SystemRoot\System32\Drivers\Beep.SYS
0xF77DF000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF77E7000 \SystemRoot\System32\drivers\vga.sys
0xF79C1000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79C3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF77EF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF77F7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF791B000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB7FF4000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xB7F9B000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB7F82000 \SystemRoot\System32\Drivers\avgtdix.sys
0xB7F5A000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB7F38000 \SystemRoot\System32\drivers\afd.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB7F0D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB7E75000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7575000 \SystemRoot\System32\Drivers\Fips.SYS
0xB7E4F000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7565000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF77FF000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xB7DFE000 \SystemRoot\System32\Drivers\avgldx86.sys
0xF7807000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xBA1AE000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF780F000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xBA1AA000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF7555000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA1A2000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF7817000 \SystemRoot\system32\DRIVERS\NuidFltr.sys
0xF7545000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xB7D83000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
0xBA19E000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF781F000 \SystemRoot\system32\DRIVERS\point32.sys
0xF7525000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB7CCB000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79F9000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7913000 \SystemRoot\System32\drivers\Dxapi.sys
0xF772F000 \SystemRoot\System32\watchdog.sys
0xBF9C3000 \SystemRoot\System32\drivers\dxg.sys
0xBA152000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9D5000 \SystemRoot\System32\G400DHD.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB596B000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB55EE000 \SystemRoot\system32\drivers\wdmaud.sys
0xB57D3000 \SystemRoot\system32\drivers\sysaudio.sys
0xB5573000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF79C9000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF79D5000 \SystemRoot\System32\Drivers\MASPINT.SYS
0xB5195000 \SystemRoot\system32\DRIVERS\srv.sys
0xB4B76000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 42):
0 System Idle Process
4 System
560 C:\WINDOWS\system32\smss.exe
624 csrss.exe
648 C:\WINDOWS\system32\winlogon.exe
692 C:\WINDOWS\system32\services.exe
704 C:\WINDOWS\system32\lsass.exe
876 C:\WINDOWS\system32\svchost.exe
944 svchost.exe
1040 C:\WINDOWS\system32\svchost.exe
1096 svchost.exe
1260 svchost.exe
1568 C:\WINDOWS\explorer.exe
1596 C:\WINDOWS\system32\spoolsv.exe
1912 svchost.exe
1992 C:\WINDOWS\system32\promon.exe
2032 C:\Program Files\BroadJump\Client Foundation\CFD.exe
2040 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
128 C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
168 C:\Program Files\Lexmark 2400 Series\ezprint.exe
288 C:\PROGRA~1\AVG\AVG8\avgtray.exe
332 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
376 C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe
400 C:\Program Files\iTunes\iTunesHelper.exe
416 C:\Program Files\FinePixViewer\QuickDCF.exe
444 C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
348 C:\Program Files\Bonjour\mDNSResponder.exe
900 C:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe
1120 C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe
1184 C:\WINDOWS\system32\mgabg.exe
1336 C:\WINDOWS\system32\svchost.exe
2016 C:\PROGRA~1\AVG\AVG8\avgemc.exe
208 C:\Program Files\AVG\AVG8\avgrsx.exe
1848 C:\Program Files\AVG\AVG8\avgcsrvx.exe
2312 C:\Program Files\iPod\bin\iPodService.exe
2336 C:\WINDOWS\system32\lxcrcoms.exe
2820 alg.exe
504 C:\WINDOWS\system32\mshta.exe
1200 C:\WINDOWS\system32\mshta.exe
3132 C:\Program Files\Mozilla Firefox\firefox.exe
3720 C:\WINDOWS\system32\mshta.exe
2464 C:\Documents and Settings\LonnyM\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: Maxtor2F040L0, Rev: VAM51JJ0

Size Device Name MBR Status
--------------------------------------------
38 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!


ComboFix 10-12-22.01 - LonnyM 12/23/2010 10:48:09.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1309 [GMT -5:00]
Running from: c:\documents and settings\LonnyM\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LonnyM\Application Data\Local
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\0.ddi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\1.ddi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\2.ddi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\3.ddi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\4.ddi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\5.ddi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\6.ddi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\fzbtqhixqcto.avi.ddr
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\ketxagyqhqcn.avi.ddr
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\mtdbypnasqdx.avi.ddr
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\mxlnajgktpcv.avi.ddr
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\ophsdsvflotc.avi.ddr
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\settings.ddi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\sspnzvyxtjot.avi.ddr
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\fzbtqhixqcto.avi.ddp
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\ketxagyqhqcn.avi.ddp
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\mtdbypnasqdx.avi.ddp
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\mxlnajgktpcv.avi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\ophsdsvflotc.avi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\sspnzvyxtjot.avi.ddp
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\wlghgydxqseq.avi
c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\wlghgydxqseq.avi.ddr
c:\documents and settings\LonnyM\Application Data\PC
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job

.
((((((((((((((((((((((((( Files Created from 2010-11-23 to 2010-12-23 )))))))))))))))))))))))))))))))
.

2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\documents and settings\LonnyM\Application Data\Malwarebytes
2010-12-22 18:48 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-22 18:48 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-22 15:58 . 2010-12-22 15:59 -------- d-----w- c:\documents and settings\LonnyM\Application Data\vlc
2010-12-22 15:55 . 2010-12-22 15:55 -------- d-----w- c:\program files\VideoLAN
2010-12-21 21:04 . 2010-12-21 21:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-12-21 21:03 . 2010-01-11 00:40 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2010-12-21 21:03 . 2010-01-11 00:40 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-12-21 16:43 . 2010-12-21 16:43 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-12-21 01:48 . 2010-12-21 01:48 -------- d-----w- c:\documents and settings\LonnyM\Application Data\DivX
2010-12-21 01:41 . 2010-12-21 16:43 -------- d-----w- c:\program files\DivX
2010-12-21 01:41 . 2010-12-21 16:38 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-12-20 13:52 . 2010-12-20 13:52 -------- d-----w- c:\documents and settings\LonnyM\Local Settings\Application Data\Opera
2010-12-20 13:52 . 2010-12-20 13:52 -------- d-----w- c:\program files\Opera
2010-12-20 04:44 . 2010-12-20 04:44 -------- d-----w- c:\documents and settings\LonnyM\Application Data\Panda Security
2010-12-20 04:32 . 2010-12-22 18:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security
2010-12-19 14:23 . 2010-12-19 14:23 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-12-18 15:40 . 2010-12-18 15:40 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Identities
2010-12-18 08:12 . 2010-12-18 08:12 -------- d-s---w- c:\documents and settings\LocalService\UserData
2010-12-18 08:11 . 2010-12-18 08:11 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2010-12-11 16:42 . 2010-12-11 16:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-12-11 16:42 . 2010-12-11 16:42 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-22 20:38 . 2008-04-14 04:14 153344 ----a-w- c:\windows\system32\drivers\dmio.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[-] 2009-01-15 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SprintModemUpdate"="javaw.exe -cp" [X]
"Promon.exe"="Promon.exe" [2000-04-13 29184]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 376912]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"lxcrmon.exe"="c:\program files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 286720]
"EzPrint"="c:\program files\Lexmark 2400 Series\ezprint.exe" [2006-02-07 98304]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
"LXCRCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 65536]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
"Matrox PowerDesk SE"="c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe" [2009-02-06 4223232]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-1-9 200704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

S2 Matrox Centering Service;Matrox Centering Service;c:\program files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe [2/6/2009 1:09 PM 1263872]
S2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe [2/6/2009 1:08 PM 344832]
.
Contents of the 'Scheduled Tasks' folder

2010-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2009-07-04 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2008-06-10 19:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\LonnyM\Application Data\Mozilla\Firefox\Profiles\lbatd972.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-DivX Download Manager - c:\program files\DivX\DivX Plus Web Player\DDmService.exe
Notify-avgrsstarter - (no file)
SafeBoot-klmdb.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-23 10:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCRCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-12-23 10:56:57
ComboFix-quarantined-files.txt 2010-12-23 15:56

Pre-Run: 26,877,255,680 bytes free
Post-Run: 26,858,795,008 bytes free

- - End Of File - - 5AC989CFEBB2E9B41878C8FF32E2A8C7

Ran Combofix in safe mode with networking, the recovery console was installed and installed Avast! antivirus.

Here is the new Combofix log:

ComboFix 10-12-22.01 - LonnyM 12/23/2010 13:20:39.2.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1304 [GMT -5:00]
Running from: c:\documents and settings\LonnyM\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-11-23 to 2010-12-23 )))))))))))))))))))))))))))))))
.

2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\documents and settings\LonnyM\Application Data\Malwarebytes
2010-12-22 18:48 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-22 18:48 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-22 15:58 . 2010-12-22 15:59 -------- d-----w- c:\documents and settings\LonnyM\Application Data\vlc
2010-12-22 15:55 . 2010-12-22 15:55 -------- d-----w- c:\program files\VideoLAN
2010-12-21 21:04 . 2010-12-21 21:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-12-21 21:03 . 2010-01-11 00:40 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2010-12-21 21:03 . 2010-01-11 00:40 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-12-21 16:43 . 2010-12-21 16:43 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-12-21 01:48 . 2010-12-21 01:48 -------- d-----w- c:\documents and settings\LonnyM\Application Data\DivX
2010-12-21 01:41 . 2010-12-21 16:43 -------- d-----w- c:\program files\DivX
2010-12-21 01:41 . 2010-12-21 16:38 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-12-20 13:52 . 2010-12-20 13:52 -------- d-----w- c:\documents and settings\LonnyM\Local Settings\Application Data\Opera
2010-12-20 13:52 . 2010-12-20 13:52 -------- d-----w- c:\program files\Opera
2010-12-20 04:44 . 2010-12-20 04:44 -------- d-----w- c:\documents and settings\LonnyM\Application Data\Panda Security
2010-12-20 04:32 . 2010-12-22 18:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security
2010-12-19 14:23 . 2010-12-19 14:23 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-12-18 15:40 . 2010-12-18 15:40 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Identities
2010-12-18 08:12 . 2010-12-18 08:12 -------- d-s---w- c:\documents and settings\LocalService\UserData
2010-12-18 08:11 . 2010-12-18 08:11 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2010-12-11 16:42 . 2010-12-11 16:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-12-11 16:42 . 2010-12-11 16:42 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-22 20:38 . 2008-04-14 04:14 153344 ----a-w- c:\windows\system32\drivers\dmio.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[-] 2009-01-15 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SprintModemUpdate"="javaw.exe -cp" [X]
"Promon.exe"="Promon.exe" [2000-04-13 29184]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 376912]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"lxcrmon.exe"="c:\program files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 286720]
"EzPrint"="c:\program files\Lexmark 2400 Series\ezprint.exe" [2006-02-07 98304]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
"LXCRCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 65536]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
"Matrox PowerDesk SE"="c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe" [2009-02-06 4223232]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-1-9 200704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

S2 Matrox Centering Service;Matrox Centering Service;c:\program files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe [2/6/2009 1:09 PM 1263872]
S2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe [2/6/2009 1:08 PM 344832]
.
Contents of the 'Scheduled Tasks' folder

2010-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2009-07-04 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2008-06-10 19:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\LonnyM\Application Data\Mozilla\Firefox\Profiles\lbatd972.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-23 13:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCRCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-12-23 13:27:24
ComboFix-quarantined-files.txt 2010-12-23 18:27
ComboFix2.txt 2010-12-23 15:56

Pre-Run: 26,850,430,976 bytes free
Post-Run: 26,840,756,224 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 6C28EB21F474D40B5B2C14C28F601D0F

Ran OTL with the text pasted in in the custom scan box.

Here are the OTL and Extras logs:

OTL logfile created on: 12/23/2010 2:17:05 PM - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\LonnyM\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.28 Gb Total Space | 23.21 Gb Free Space | 60.64% Space Free | Partition Type: NTFS

Computer Name: LONNY | User Name: LonnyM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/23 14:14:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe
PRC - [2010/12/11 12:15:28 | 000,910,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/09/07 11:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2009/02/06 13:09:16 | 001,263,872 | ---- | M] (Matrox Graphics Inc.) -- c:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe
PRC - [2009/02/06 13:08:32 | 004,223,232 | ---- | M] (Matrox Graphics Inc.) -- C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe
PRC - [2009/02/06 13:08:28 | 000,344,832 | ---- | M] (Matrox Graphics Inc) -- c:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe
PRC - [2008/04/14 04:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/04 07:48:42 | 000,087,560 | ---- | M] (Matrox Graphics Inc.) -- C:\WINDOWS\system32\mgabg.exe
PRC - [2006/02/07 00:10:34 | 000,098,304 | ---- | M] (Lexmark International Inc.) -- C:\Program Files\Lexmark 2400 Series\ezprint.exe
PRC - [2006/02/02 22:11:22 | 000,495,616 | ---- | M] ( ) -- C:\WINDOWS\system32\lxcrcoms.exe
PRC - [2006/01/22 12:45:08 | 000,286,720 | ---- | M] () -- C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
PRC - [2003/01/27 16:16:58 | 000,376,912 | ---- | M] () -- C:\Program Files\BroadJump\Client Foundation\CFD.exe
PRC - [2002/01/09 20:53:14 | 000,200,704 | ---- | M] (FUJI PHOTO FILM CO., LTD.) -- C:\Program Files\FinePixViewer\QuickDCF.exe
PRC - [2000/04/13 06:34:18 | 000,029,184 | R--- | M] (Intel Corporation) -- C:\WINDOWS\system32\promon.exe


========== Modules (SafeList) ==========

MOD - [2010/12/23 14:14:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe


========== Win32 Services (SafeList) ==========

SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/02/06 13:09:16 | 001,263,872 | ---- | M] (Matrox Graphics Inc.) [Auto | Running] -- c:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe -- (Matrox Centering Service)
SRV - [2009/02/06 13:08:28 | 000,344,832 | ---- | M] (Matrox Graphics Inc) [Auto | Running] -- c:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe -- (Matrox.Pdesk.ServicesHost)
SRV - [2007/04/04 07:48:42 | 000,087,560 | ---- | M] (Matrox Graphics Inc.) [Auto | Running] -- C:\WINDOWS\system32\mgabg.exe -- (MGABGEXE)
SRV - [2006/02/02 22:11:22 | 000,495,616 | ---- | M] ( ) [On_Demand | Running] -- C:\WINDOWS\System32\lxcrcoms.exe -- (lxcr_device)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\LonnyM\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/09/07 10:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/07 10:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/07 10:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/07 10:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/09/07 10:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/07 10:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009/02/06 12:19:52 | 000,350,592 | ---- | M] (Matrox Graphics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\g400dhm.sys -- (G400DH)
DRV - [2001/08/17 07:49:42 | 000,322,432 | ---- | M] (Matrox Graphics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\G400m.sys -- (G400)
DRV - [2001/08/17 07:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM)
DRV - [2000/03/29 16:11:20 | 000,008,096 | ---- | M] (MicroStaff Co.,Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\MASPINT.SYS -- (MASPINT)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com"

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/11 12:15:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/21 11:43:32 | 000,000,000 | ---D | M]

[2009/06/30 20:18:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\Mozilla\Extensions
[2009/06/30 20:18:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\Mozilla\Firefox\Profiles\lbatd972.default\extensions
[2009/06/30 20:18:02 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/12/23 10:53:43 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2400 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
O4 - HKLM..\Run: [LXCRCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.DLL ()
O4 - HKLM..\Run: [lxcrmon.exe] C:\Program Files\Lexmark 2400 Series\lxcrmon.exe ()
O4 - HKLM..\Run: [Matrox PowerDesk SE] c:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe (Matrox Graphics Inc.)
O4 - HKLM..\Run: [Promon.exe] C:\WINDOWS\System32\promon.exe (Intel Corporation)
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [SprintModemUpdate] C:\WINDOWS\System32\javaw.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\LonnyM\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\LonnyM\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/30 20:49:06 | 000,000,018 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/06/29 21:34:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BIT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/12/23 14:14:39 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe
[2010/12/23 13:58:19 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/12/23 13:44:01 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/12/23 13:44:00 | 000,165,584 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/12/23 13:43:58 | 000,023,376 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/12/23 13:43:56 | 000,046,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/12/23 13:43:53 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/12/23 13:43:53 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/12/23 13:43:52 | 000,028,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/12/23 13:43:20 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2010/12/23 13:43:19 | 000,167,592 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/12/23 13:30:26 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/12/23 13:30:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/12/23 13:27:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/12/23 13:18:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/12/23 13:15:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC
[2010/12/23 10:45:44 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/12/23 10:45:44 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/12/23 10:45:44 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/12/23 10:45:44 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/12/23 10:45:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/12/22 20:08:25 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/12/22 18:31:48 | 005,473,272 | ---- | C] (OPSWAT, Inc.) -- C:\Documents and Settings\LonnyM\Desktop\AppRemover.exe
[2010/12/22 13:48:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\Malwarebytes
[2010/12/22 13:48:26 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/22 13:48:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/12/22 13:48:21 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/22 13:48:21 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/22 13:46:55 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\LonnyM\Desktop\mbam-setup-1.50.1.1100.exe
[2010/12/22 13:35:22 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\TFC.exe
[2010/12/22 10:58:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\vlc
[2010/12/22 10:55:47 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2010/12/21 16:04:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/12/21 11:43:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DivX Shared
[2010/12/20 20:49:22 | 000,000,000 | R--D | C] -- C:\Documents and Settings\LonnyM\My Documents\My Videos
[2010/12/20 20:48:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\DivX
[2010/12/20 20:41:58 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
[2010/12/20 20:41:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DivX
[2010/12/20 08:52:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Local Settings\Application Data\Opera
[2010/12/20 08:52:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\Opera
[2010/12/20 08:52:34 | 000,000,000 | ---D | C] -- C:\Program Files\Opera
[2010/12/19 23:44:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\Panda Security
[2010/12/19 23:32:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Panda Security
[2010/12/19 09:23:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
[2010/12/19 09:23:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2010/12/19 09:23:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/12/18 10:40:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Identities
[2010/12/18 10:40:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Identities
[2010/12/18 03:11:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2010/12/18 03:11:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Apple Computer
[2010/12/16 15:55:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/12/16 09:47:52 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\LonnyM\Desktop\TDSSKiller.exe
[2010/12/11 11:42:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer
[2010/12/11 11:42:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Apple Computer
[2009/08/01 17:28:35 | 000,409,600 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrinpa.dll
[2009/08/01 17:28:35 | 000,393,216 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcriesc.dll
[2009/08/01 17:23:38 | 001,183,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrserv.dll
[2009/08/01 17:23:38 | 000,995,328 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrusb1.dll
[2009/08/01 17:23:38 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrprox.dll
[2009/08/01 17:23:37 | 000,536,576 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrlmpm.dll
[2009/08/01 17:23:37 | 000,114,688 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrpplc.dll
[2009/08/01 17:23:35 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomm.dll
[2009/08/01 17:23:34 | 000,610,304 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomc.dll

========== Files - Modified Within 30 Days ==========

[2010/12/23 14:14:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe
[2010/12/23 13:55:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/12/23 13:55:37 | 1609,945,088 | -HS- | M] () -- C:\hiberfil.sys
[2010/12/23 13:44:02 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/12/23 13:43:54 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/12/23 13:18:17 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/12/23 11:00:51 | 000,000,415 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\Shortcut to ComboFix.lnk
[2010/12/23 10:53:43 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/12/22 18:32:47 | 003,996,586 | R--- | M] () -- C:\Documents and Settings\LonnyM\Desktop\ComboFix.exe
[2010/12/22 18:32:24 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\MBRCheck.exe
[2010/12/22 18:31:50 | 005,473,272 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\LonnyM\Desktop\AppRemover.exe
[2010/12/22 16:49:24 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/12/22 15:34:24 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\tdsskiller.zip
[2010/12/22 15:25:07 | 000,013,312 | ---- | M] () -- C:\Documents and Settings\LonnyM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/22 14:05:15 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\4umf5hup.exe
[2010/12/22 13:48:26 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/22 13:47:20 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\LonnyM\Desktop\mbam-setup-1.50.1.1100.exe
[2010/12/22 13:35:23 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\TFC.exe
[2010/12/22 10:57:34 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/12/21 16:43:41 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/20 08:52:44 | 000,001,510 | ---- | M] () -- C:\Documents and Settings\LonnyM\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2010/12/20 08:52:44 | 000,001,492 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/12/17 20:10:07 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/12/16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\LonnyM\Desktop\TDSSKiller.exe

========== Files Created - No Company Name ==========

[2010/12/23 13:44:02 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/12/23 13:32:20 | 1609,945,088 | -HS- | C] () -- C:\hiberfil.sys
[2010/12/23 13:18:17 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/12/23 13:18:13 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/12/23 11:00:51 | 000,000,415 | ---- | C] () -- C:\Documents and Settings\LonnyM\Desktop\Shortcut to ComboFix.lnk
[2010/12/23 10:45:44 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/12/23 10:45:44 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/12/23 10:45:44 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/12/23 10:45:44 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/12/23 10:45:44 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/12/22 18:32:46 | 003,996,586 | R--- | C] () -- C:\Documents and Settings\LonnyM\Desktop\ComboFix.exe
[2010/12/22 18:32:24 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\LonnyM\Desktop\MBRCheck.exe
[2010/12/22 15:34:09 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\LonnyM\Desktop\tdsskiller.zip
[2010/12/22 14:05:14 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\LonnyM\Desktop\4umf5hup.exe
[2010/12/22 13:48:26 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/22 10:57:34 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/12/20 08:52:44 | 000,001,510 | ---- | C] () -- C:\Documents and Settings\LonnyM\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2010/12/20 08:52:44 | 000,001,492 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2009/11/26 19:14:47 | 000,013,312 | ---- | C] () -- C:\Documents and Settings\LonnyM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/16 21:28:23 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2009/08/18 19:41:23 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\WNASPI32.DLL
[2009/08/18 19:41:23 | 000,000,291 | ---- | C] () -- C:\WINDOWS\msfsetup.ini
[2009/08/01 17:28:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxcrvs.dll
[2009/08/01 17:28:33 | 000,303,104 | ---- | C] () -- C:\WINDOWS\System32\lxcrcoin.dll
[2009/08/01 17:27:41 | 000,684,032 | ---- | C] () -- C:\WINDOWS\System32\lxcrdrs.dll
[2009/08/01 17:27:41 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxcrcaps.dll
[2009/08/01 17:27:40 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\lxcrcnv4.dll
[2009/08/01 17:27:06 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\LXPRMON.DLL
[2009/08/01 17:27:06 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXPMONUI.DLL
[2009/08/01 17:23:39 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\LXCRinst.dll
[2009/07/03 09:28:35 | 000,663,552 | ---- | C] () -- C:\WINDOWS\System32\libeay32_1-1-0_DDR.dll
[2009/07/03 09:28:35 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32_1-1-0_DDR.dll
[2009/07/03 09:28:34 | 000,532,594 | ---- | C] () -- C:\WINDOWS\System32\xerces-c_1_40_0_DDR.dll
[2009/07/03 09:28:34 | 000,524,377 | ---- | C] () -- C:\WINDOWS\System32\stlport_4_0_0_DDR.dll
[2009/07/03 09:28:34 | 000,307,329 | ---- | C] () -- C:\WINDOWS\System32\BJBase_2-2-2_DDR.dll
[2009/06/29 17:15:23 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

========== LOP Check ==========

[2010/12/23 13:30:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/09/21 20:32:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Matrox
[2009/09/21 20:32:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Matrox Graphics Inc
[2010/12/22 13:13:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Security
[2010/12/21 16:26:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/07/30 18:04:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/10 20:47:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/07/04 11:01:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/08/18 19:49:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\FUJIFILM
[2010/12/20 08:52:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\Opera
[2010/12/19 23:44:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\Panda Security

========== Purity Check ==========



========== Custom Scans ==========


< >

< %SYSTEMDRIVE%\*.* >
[2009/06/30 20:49:06 | 000,000,018 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/06/29 21:34:34 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BIT
[2009/12/23 19:44:20 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/12/23 13:18:17 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/12/23 13:27:24 | 000,007,997 | ---- | M] () -- C:\ComboFix.txt
[2009/06/29 21:34:34 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/12/23 13:55:37 | 1609,945,088 | -HS- | M] () -- C:\hiberfil.sys
[2009/06/29 21:50:59 | 000,000,090 | ---- | M] () -- C:\inf.log
[2009/06/29 21:34:34 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/12/22 13:11:24 | 000,003,874 | ---- | M] () -- C:\lxcr.log
[2010/12/23 13:55:54 | 000,003,244 | ---- | M] () -- C:\lxcrscan.log
[2009/06/29 21:34:34 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/13 21:13:04 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/13 23:01:44 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/12/23 13:55:34 | 402,653,184 | -HS- | M] () -- C:\pagefile.sys
[2009/06/29 21:53:37 | 000,000,169 | ---- | M] () -- C:\setup.log
[2009/06/29 21:53:32 | 000,000,179 | ---- | M] () -- C:\setup1.log
[2009/09/19 10:20:46 | 000,000,000 | ---- | M] () -- C:\t1bc.2
[2009/09/19 10:20:46 | 000,000,000 | ---- | M] () -- C:\t1bc.3

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/29 21:33:37 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/01/12 09:20:04 | 000,114,688 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxcrpp5c.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 11:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/06/29 17:08:11 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/06/29 17:08:11 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/06/29 17:08:10 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/06/29 21:34:45 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/06/29 21:47:50 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\LonnyM\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/06/29 21:47:49 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\LonnyM\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/12/22 14:05:15 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\4umf5hup.exe
[2010/12/22 18:31:50 | 005,473,272 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\LonnyM\Desktop\AppRemover.exe
[2010/12/22 18:32:47 | 003,996,586 | R--- | M] () -- C:\Documents and Settings\LonnyM\Desktop\ComboFix.exe
[2009/01/11 20:35:49 | 007,518,240 | ---- | M] (Mozilla) -- C:\Documents and Settings\LonnyM\Desktop\Firefox Setup 3.0.5.exe
[2009/07/04 10:46:11 | 077,690,152 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\LonnyM\Desktop\iTunesSetup.exe
[2010/12/22 13:47:20 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\LonnyM\Desktop\mbam-setup-1.50.1.1100.exe
[2010/12/22 18:32:24 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\MBRCheck.exe
[2010/12/23 14:14:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe
[2010/12/16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\LonnyM\Desktop\TDSSKiller.exe
[2010/12/22 13:35:23 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\TFC.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/06/29 21:47:49 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\LonnyM\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/12/23 13:55:50 | 000,032,768 | ---- | M] () -- C:\Documents and Settings\LonnyM\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2008/04/14 04:42:40 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/14 04:41:52 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2007/04/02 22:37:24 | 000,004,821 | R--- | M] () -- C:\Program Files\Messenger\logowin.gif
[2007/04/02 22:37:24 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 22:00:30 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 04:42:30 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2002/08/20 14:29:48 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2002/08/20 14:30:06 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2002/08/20 14:30:06 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2007/04/02 22:37:28 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2007/04/02 22:34:02 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >


OTL Extras logfile created on: 12/23/2010 2:17:05 PM - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\LonnyM\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.28 Gb Total Space | 23.21 Gb Free Space | 60.64% Space Free | Partition Type: NTFS

Computer Name: LONNY | User Name: LonnyM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNetisabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNetisabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNetisabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNetisabledxpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\Alwil Software\Avast5\AvastUI.exe" = C:\Program Files\Alwil Software\Avast5\AvastUI.exe:*:Enabled:avast! Free Antivirus -- (AVAST Software)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02F6993D-B763-4F40-8F93-2A9CD97586E3}" = Microsoft IntelliType Pro 6.3
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Toolbar
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.3.2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
"{66A9D30D-1464-4C7F-B2F3-507DADAF2595}" = Microsoft IntelliPoint 6.3
"{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9AA7D28F-7C66-45BD-95C0-BEC00CEFD34A}" = Matrox PowerDesk-SE
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{D3AA158A-9421-4883-8767-E771B0964A1D}" = ImageMixer VCD for FinePix
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast5" = avast! Free Antivirus
"BroadJump Client Foundation" = BroadJump Client Foundation
"CCleaner" = CCleaner (remove only)
"InstallShield_{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.3.2
"Lexmark 2400 Series" = Lexmark 2400 Series
"Lexmark Fax Solutions" = Lexmark Fax Solutions
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Matrox Graphics Uninstaller" = Matrox Graphics Software (remove only)
"Mozilla Firefox (3.5.16)" = Mozilla Firefox (3.5.16)
"MSNINST" = MSN
"MWASPI" = MicroStaff WINASPI
"Opera 11.00.1156" = Opera 11.00
"PROSet" = Intel(R) Network Connections Drivers
"VLC media player" = VLC media player 1.1.5
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

========== Last 10 Event Log Errors ==========

[ System Events ]
Error - 12/23/2010 2:31:29 PM | Computer Name = LONNY | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/23/2010 2:32:38 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC90.MFC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 12/23/2010 2:32:38 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC90.MFC. Reference error
message: The referenced assembly is not installed on your system. .

Error - 12/23/2010 2:32:38 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Alwil Software\Avast5\avastUI.exe.
Reference
error message: The operation completed successfully. .

Error - 12/23/2010 2:32:49 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC90.MFC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 12/23/2010 2:32:49 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC90.MFC. Reference error
message: The referenced assembly is not installed on your system. .

Error - 12/23/2010 2:32:49 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Alwil Software\Avast5\AvastUI.exe.
Reference
error message: The operation completed successfully. .

Error - 12/23/2010 2:33:25 PM | Computer Name = LONNY | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 12/23/2010 2:41:12 PM | Computer Name = LONNY | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 12/23/2010 2:56:29 PM | Computer Name = LONNY | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt


< End of report >

Updated java and removed all old versions, Ran Security Check, TFC and did the ESET online scan. ESET did not find any threats so there was no log file.

Here is the Security Check log:

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
Antivirus out of date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner (remove only)
Java(TM) 6 Update 23
Out of date Java installed!
Adobe Flash Player 10.1.53.64
Adobe Reader 9.1
Out of date Adobe Reader installed!
Mozilla Firefox (3.5.16) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 avastUI.exe
``````````End of Log````````````

Finally got around to finishing with the updates.

Updated to Ie8.
Updated to the latest Firefox version.
Updated Adobe Reader.
Ran OTL run fix and OTL clean up.
Windows updates are current.
Installed WOT for firefox.

The computer seems to be fixed, haven't had an issue with the browser redirect since running through your removal process.

Here is the OTL log for the run fix:

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes

User: LonnyM
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3221006 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 3.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: LonnyM
->Flash cache emptied: 0 bytes

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.18.0 log created on 12272010_162554

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...