I'm so beyond frustrated with this virus/malware/'THING' that has taken over my computer. I have posted my System Look Log and my HiJack This Log below. Malwarebytes would not execute after installing. I’m hoping you can help . This computer is only a couple months old.

Computer Symptoms –
-Music/commercial/jingles play in the background even when I do not have an open browser.
-Internet windows opens un-expectantly with ads
-Slow Internet – Windows locking up – Microsoft Office won’t sync with server
-Microsoft office files shut down in the middle of work or files are missing.

Thank You so much in advance for any help you may be able to provide!! ~Laurie


----------------System Look Log------------------
SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 09:58 on 17/12/2009 by Laurie Mummert (Administrator - Elevation successful)

========== filefind ==========

Searching for "scecli.dll"
C:\WINDOWS\system32\scecli.dll --a--- 181248 bytes [16:16 25/04/2008] [12:00 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084

Searching for "netlogon.dll"
C:\WINDOWS\system32\netlogon.dll --a--- 407040 bytes [16:16 25/04/2008] [12:00 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550

Searching for "eventlog.dll"
C:\WINDOWS\system32\eventlog.dll --a--- 56320 bytes [16:16 25/04/2008] [12:00 14/04/2008] 6D4FEB43EE538FC5428CC7F0565AA656

Searching for "winlogon.exe"
C:\WINDOWS\system32\winlogon.exe --a--- 507904 bytes [16:16 25/04/2008] [12:00 14/04/2008] ED0EF0A136DEC83DF69F04118870003E

Searching for "comres.dll"
C:\WINDOWS\system32\comres.dll --a--- 792064 bytes [16:16 25/04/2008] [12:00 14/04/2008] 1280A158C722FA95A80FB7AEBE78FA7D

Searching for "crypt32.dll"
C:\WINDOWS\system32\crypt32.dll --a--- 599040 bytes [16:16 25/04/2008] [12:00 14/04/2008] BDAAF79DD63F194434D31A74B9BB8B77

Searching for "gpedit.dll"
C:\WINDOWS\system32\gpedit.dll --a--- 566784 bytes [16:16 25/04/2008] [12:00 14/04/2008] 65F8DA8424AD27A365F61CCC8621FED2

Searching for "rundll32.exe"
C:\WINDOWS\system32\rundll32.exe --a--- 33280 bytes [16:16 25/04/2008] [12:00 14/04/2008] 037B1E7798960E0420003D05BB577EE6

Searching for "sfc.dll"
C:\WINDOWS\system32\sfc.dll --a--- 5120 bytes [16:16 25/04/2008] [12:00 14/04/2008] 96E1C926F22EE1BFBAE82901A35F6BF3

Searching for "svchost.exe"
C:\WINDOWS\system32\svchost.exe --a--- 14336 bytes [16:16 25/04/2008] [12:00 14/04/2008] 27C6D03BCDB8CFEB96B716F3D8BE3E18

Searching for "cngaudit.dll"
No files found.

-=End Of File=-


---------------------HijackThis Log-----------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:02 AM, on 12/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\dumprep.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (file missing)
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe_Reader] c:\docume~1\laurie~1\locals~1\temp\\wmpscfgs.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10b.exe (User 'Default user')
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 8871 bytes

Mod Edit - Removed email address from post so as not to attract SPAM Bots.

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
  O4 - HKLM\..\Run: [Adobe_Reader] c:\docume~1\laurie~1\locals~1\temp\\wmpscfgs.exe
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.42
Database version: 3382
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/17/2009 2:37:02 PM
mbam-log-2009-12-17 (14-37-02).txt

Scan type: Quick Scan
Objects scanned: 128886
Time elapsed: 12 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Adobe\acrotray.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Adobe\acrotray .exe (Trojan.Agent) -> Quarantined and deleted successfully.

Hello.

• Download combofix from here
  Link 1
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 09-12-16.05 - Laurie Mummert 12/17/2009 16:56:11.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1637 [GMT -6:00]
Running from: c:\documents and settings\Laurie Mummert\Desktop\Combo-Fix.exe
AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\adobe\acrotray.exe
c:\windows\system32\ctfmon .exe
c:\windows\system32\hkcmd .exe
c:\windows\system32\igfxpers .exe
c:\windows\system32\igfxtray .exe
c:\windows\system32\mrt .exe

.
((((((((((((((((((((((((( Files Created from 2009-11-17 to 2009-12-17 )))))))))))))))))))))))))))))))
.

2009-12-17 18:11 . 2009-12-17 18:13 5299337 ----a-w- c:\documents and settings\All Users\Application Data\ArcSoft\Global Deploy\CheckUpdate\ArcConnect.exe
2009-12-17 18:11 . 2009-12-17 18:11 -------- d-----w- c:\documents and settings\Laurie Mummert\Local Settings\Application Data\ArcSoft
2009-12-17 18:11 . 2009-12-17 18:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft
2009-12-17 18:09 . 2006-11-10 21:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys
2009-12-17 18:09 . 2005-04-27 22:36 245408 ----a-w- c:\windows\system32\unicows.dll
2009-12-17 18:08 . 2009-12-17 18:09 -------- d-----w- c:\program files\Common Files\ArcSoft
2009-12-17 18:08 . 2009-12-17 18:08 -------- d-----w- c:\program files\ArcSoft
2009-12-17 18:08 . 2009-12-17 18:11 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\ArcSoft
2009-12-17 17:23 . 2009-12-17 17:23 103424 ----a-w- c:\windows\system32\WinFormSculptor_nat.dll
2009-12-16 21:44 . 2009-12-03 22:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-16 21:44 . 2009-12-17 20:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-16 21:44 . 2009-12-03 22:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-16 21:39 . 2009-12-16 21:39 -------- d-----w- c:\program files\ERUNT
2009-12-16 21:18 . 2009-12-16 21:18 -------- d-----w- c:\program files\Trend Micro
2009-12-16 20:53 . 2009-12-16 20:54 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\BACS.exe
2009-12-16 20:53 . 2009-12-16 20:53 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\AVG8
2009-12-16 18:50 . 2009-12-16 18:52 -------- d-----w- c:\windows\system32\NtmsData
2009-12-16 17:07 . 2005-09-13 07:02 176128 ------w- c:\windows\system32\BrfxDA5a.dll
2009-12-15 22:22 . 2009-12-15 22:22 -------- d-----w- c:\program files\AVG
2009-12-15 22:22 . 2009-12-16 18:37 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-12-15 21:58 . 2009-12-15 23:31 -------- d-----w- c:\documents and settings\Laurie Mummert\Local Settings\Application Data\Corel
2009-12-15 21:57 . 2009-12-15 23:31 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-12-15 21:57 . 2009-12-15 23:31 88 --sh--r- c:\windows\system32\42FA60492C.sys
2009-12-15 21:09 . 2009-11-03 02:42 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-12-15 21:04 . 2009-12-17 22:52 -------- d-----w- c:\program files\Windows Defender
2009-12-15 17:28 . 2009-12-15 17:28 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\Malwarebytes
2009-12-15 17:28 . 2009-12-15 17:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-15 17:19 . 2009-12-15 21:57 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\Corel
2009-12-15 17:19 . 2009-12-15 17:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Corel
2009-12-15 17:14 . 2009-12-15 17:16 -------- d-----w- c:\program files\Common Files\Corel
2009-12-15 17:03 . 2009-12-15 17:14 -------- d-----w- c:\program files\Corel
2009-12-15 17:03 . 2009-12-15 17:03 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\InstallShield
2009-12-14 20:02 . 2009-12-14 20:27 -------- d-----w- C:\tmp
2009-12-14 17:49 . 2009-12-14 17:49 -------- d-----w- C:\$UPGRADE.~OS
2009-12-14 17:48 . 2009-12-14 17:48 -------- d-----w- C:\$WINDOWS.~BT
2009-12-14 17:47 . 2009-12-14 17:47 -------- d-----w- c:\documents and settings\Laurie Mummert\Local Settings\Application Data\MigWiz
2009-12-14 17:39 . 2009-12-14 17:39 -------- d-----w- c:\windows\system32\MpEngineStore
2009-12-14 16:51 . 2009-12-14 16:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-12-12 01:01 . 2009-12-12 01:01 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE
2009-12-12 01:01 . 2009-12-12 01:01 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Windows Search
2009-12-11 23:17 . 2009-12-11 23:17 -------- d-----w- c:\documents and settings\Laurie Mummert\Local Settings\Application Data\Symantec
2009-12-11 22:08 . 2009-12-11 22:08 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-12-11 22:06 . 2009-12-11 22:06 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Windows Search
2009-12-09 00:39 . 2009-12-09 00:42 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-12-04 18:15 . 2009-12-04 18:15 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\Curious Sense
2009-12-04 18:15 . 2009-12-04 18:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Curious Sense
2009-12-03 22:09 . 2009-12-03 22:09 -------- d-----w- c:\documents and settings\All Users\Application Data\XLab
2009-12-02 19:52 . 2009-12-02 19:52 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-02 19:50 . 2009-12-02 19:50 -------- d-----w- C:\spoolerlogs
2009-11-27 20:25 . 2009-11-27 20:25 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-11-27 19:27 . 2009-11-27 19:27 -------- d-----w- c:\documents and settings\All Users\Application Data\iWin Games
2009-11-24 21:10 . 2009-11-24 21:10 -------- d-----w- c:\documents and settings\All Users\Application Data\GameHouse
2009-11-24 16:43 . 2009-11-24 16:43 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\Sudden Games LLC
2009-11-24 16:42 . 2009-11-24 16:42 4096 ----a-w- c:\windows\d3dx.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-17 18:13 . 2009-10-14 04:48 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-16 18:49 . 2009-10-14 04:36 75352 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-16 17:19 . 2009-10-19 23:28 57 ----a-w- c:\documents and settings\All Users\Application Data\Brother\BrLog\BrCollectDir\BR_cat.bat
2009-12-16 17:09 . 2009-10-19 23:32 65 ----a-w- c:\windows\system32\BD8860DN.DAT
2009-12-15 21:18 . 2009-11-06 21:37 -------- d-----w- c:\program files\Google
2009-12-15 21:10 . 2009-11-17 18:15 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\uTorrent
2009-12-11 23:07 . 2009-10-14 04:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-12-10 13:53 . 2009-10-14 04:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-08 15:46 . 2009-11-12 15:42 79488 ----a-w- c:\documents and settings\Laurie Mummert\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-27 13:14 . 2009-10-14 04:41 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-17 19:12 . 2009-11-17 19:12 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\PlayFirst
2009-11-17 19:12 . 2009-11-17 19:12 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-11-17 18:36 . 2009-11-17 18:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Islands
2009-11-12 18:43 . 2009-11-12 18:43 -------- d-----w- c:\program files\Citrix
2009-11-12 18:42 . 2009-11-12 18:42 60744 ----a-w- c:\documents and settings\Laurie Mummert\g2mdlhlpx.exe
2009-11-06 22:07 . 2009-11-06 22:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Trymedia
2009-10-31 09:23 . 2009-10-14 04:39 -------- d-----w- c:\program files\Microsoft Works
2009-10-29 07:45 . 2008-04-25 16:16 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-26 19:21 . 2009-10-26 14:43 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\Individual Software
2009-10-26 19:20 . 2009-10-26 14:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Individual Software
2009-10-26 19:19 . 2009-10-26 14:42 -------- d-----w- c:\program files\Individual Software
2009-10-26 14:42 . 2009-10-26 14:42 -------- d-----w- c:\program files\Common Files\Individual Software
2009-10-23 23:53 . 2009-10-14 04:50 -------- d-----w- c:\program files\Microsoft SQL Server
2009-10-23 19:35 . 2009-10-23 19:35 -------- d-----r- c:\documents and settings\Laurie Mummert\Application Data\Brother
2009-10-22 14:57 . 2009-10-14 04:47 -------- d-----w- c:\program files\Microsoft Silverlight
2009-10-22 12:22 . 2009-10-22 12:22 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-10-22 12:22 . 2009-10-22 12:22 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-10-21 15:59 . 2009-10-21 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-10-21 05:38 . 2008-04-25 16:16 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2008-04-25 16:16 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2008-04-14 00:23 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-19 23:46 . 2009-10-19 23:46 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\ScanSoft
2009-10-19 23:32 . 2009-10-19 23:32 -------- d-----w- c:\program files\Brother
2009-10-19 23:32 . 2009-10-14 04:40 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-19 23:29 . 2009-10-19 23:29 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2009-10-19 23:29 . 2009-10-19 23:29 -------- d-----w- c:\program files\ScanSoft
2009-10-19 23:29 . 2009-10-19 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\ScanSoft
2009-10-19 23:28 . 2009-10-19 23:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Brother
2009-10-19 21:39 . 2009-10-19 21:39 -------- d-----w- c:\documents and settings\Laurie Mummert\Application Data\Windows Search
2009-10-14 07:20 . 2009-10-14 07:20 77824 ----a-w- c:\windows\setpwr32.exe
2009-10-14 04:50 . 2009-10-19 21:36 68848 ----a-w- c:\documents and settings\Laurie Mummert\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-14 04:36 . 2009-10-14 04:36 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-10-14 04:29 . 2008-04-25 21:28 87263 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-13 10:30 . 2008-04-25 16:16 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2008-04-25 16:16 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2008-04-25 16:16 79872 ----a-w- c:\windows\system32\raschap.dll
.

Code:

<pre>
c:\program files\Adobe\acrotray .exe
c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl .exe
c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray .exe
c:\program files\Analog Devices\Core\smax4pnp .exe
c:\program files\AVG\AVG9\avgtray .exe
c:\program files\Brother\Brmfl05c\brstdvpt .exe
c:\program files\Brother\ControlCenter2\brctrcen .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\acdaemon .exe
c:\program files\Common Files\Corel\Corel PhotoDownloader\corel photo downloader .exe
c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\ssbkgdupdate .exe
c:\program files\CyberLink\PowerDVD DX\pdvddxsrv .exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\Malwarebytes' Anti-Malware\mbam .exe
c:\program files\ScanSoft\PaperPort\indexsearch .exe
c:\program files\ScanSoft\PaperPort\pptd40nt .exe
c:\program files\Windows Defender\msascui .exe
c:\program files\Windows Live\Messenger\msnmsgr .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-10-03 38768]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2009-12-17 912268]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-11-12 995328]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-12-17 926016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10b.exe" [2009-02-03 240544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [10/14/2009 1:20 AM 24064]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R3 k57w2k;Broadcom NetLink (TM) Gigabit Ethernet;c:\windows\system32\drivers\k57xp32.sys [10/14/2009 1:20 AM 176640]
S1 jbiulapq;jbiulapq;\??\c:\windows\system32\drivers\jbiulapq.sys --> c:\windows\system32\drivers\jbiulapq.sys [?]
.
------- Supplementary Scan -------
.
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-17 17:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-12-17 17:00:58
ComboFix-quarantined-files.txt 2009-12-17 23:00

Pre-Run: 139,584,364,544 bytes free
Post-Run: 139,982,594,048 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 6A63121515FE9812FFC6E3E703B8942D

Hello.
Once were done here, some programs may not work correctly (a few being MBAM/AVG/MSN/PowerDVD, etc) because the malware has patched them and this results in damage to the files. Re-installing those applications will fix it.

1. Close any open browsers.
   
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
3. Open notepad and copy/paste the text in the quotebox below into it:
   

   
   File::
   c:\program files\Adobe\acrotray .exe
   c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl .exe
   c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray .exe
   c:\program files\Analog Devices\Core\smax4pnp .exe
   c:\program files\AVG\AVG9\avgtray .exe
   c:\program files\Brother\Brmfl05c\brstdvpt .exe
   c:\program files\Brother\ControlCenter2\brctrcen .exe
   c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
   c:\program files\Common Files\ArcSoft\Connection Service\Bin\acdaemon .exe
   c:\program files\Common Files\Corel\Corel PhotoDownloader\corel photo downloader .exe
   c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\ssbkgdupdate .exe
   c:\program files\CyberLink\PowerDVD DX\pdvddxsrv .exe
   c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier .exe
   c:\program files\Java\jre6\bin\jusched .exe
   c:\program files\Malwarebytes' Anti-Malware\mbam .exe
   c:\program files\ScanSoft\PaperPort\indexsearch .exe
   c:\program files\ScanSoft\PaperPort\pptd40nt .exe
   c:\program files\Windows Defender\msascui .exe
   c:\program files\Windows Live\Messenger\msnmsgr .exe
   
   Driver::
   jbiulapq
   

   
   
4. Save this as CFScript.txt, in the same location as ComboFix.exe
   
   
   
   
5. Referring to the picture above, drag CFScript into ComboFix.exe
   
6. When finished, it shall produce a log for you at C:\ComboFix.txt
   
7. Please post the contents of the log in your next reply.