Solved CashTitan - beware

[Resolved] CashTitan - beware

Does anyone know about "Tagging System CashTitan ".
It seems to be some type of MalWare and even though it appears in the Add/Remove Programs list any attempt to uninstall it prompts you for a password.

It appears to randomly open urls (with the default web browser) which are advertisements.

Besides that I also noticed that all my 'restore points' mysteriously disappeared which prevented me from restoring Windows to an earlier date - I have previously restored Windows to a previous date to remove nasties.

Does anyone know of and free SpyWare removers. I tried AdAware and also Spyware Doctor (advertised here) but after installation when I tried to update the signature file all attempts failed - could this be also be 'controlled' by CashTitan?

 

Sorry I have NO IDEA what 'logs' you refer to.
I have 'posted' all the information I can think of.
The random windows which appear look like an Internet Explorer window and are usually headed "RON ads by cashtitan" and advertise 'scratch 2 cash'.
I come from an IT industry (some year ago) and know what 'logs' are but this time I am 'stumped' as what is required.
Do you mean the html code of the web page displayed?

 

Sorry,
I DID click on the link earlier but after waiting for several minutes nothing happened. I wasn't sure if this was because the server was busy, down or that somehow my MalWare was preventing access.
I'll try again

 

Thanks for the info.
I WAS able to get to the link and download from another PC - that is really worrying me now as my PC must have some terrible MalWare. I was considering reformatting and reloading Windows and applications which would take hours. Hopefully now I won't have to do that.
I ran the software, saved the .txt files and had to copy them to a usb stick and go back to the other PC to send them as I ALSO now cannot post a reply from the infected PC (everything else appears to operate ok).
I could not find a method to attach the files to this post so assume that I need to include the text as a 'cut and paste' so here it is -

ATTACH LOG

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/27/2010 10:20:59 PM
System Uptime: 8/17/2010 8:30:53 PM (0 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | EG41MF-US2H
Processor: Intel Pentium III Xeon processor | Socket 775 | 2933/266mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 98 GiB total, 82.139 GiB free.
D: is FIXED (NTFS) - 98 GiB total, 20.772 GiB free.
E: is FIXED (NTFS) - 137 GiB total, 64.611 GiB free.
F: is FIXED (NTFS) - 98 GiB total, 95.404 GiB free.
G: is FIXED (NTFS) - 36 GiB total, 18.679 GiB free.
H: is CDROM ()
I: is Removable
J: is CDROM (CDFS)
K: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP210: 8/15/2010 5:21:44 PM - System Checkpoint
RP211: 8/16/2010 4:39:37 PM - Restore Operation
RP212: 8/17/2010 5:41:57 PM - Avg Update

==== Installed Programs ======================

µTorrent
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.2.3
Arachnophilia version 4.0
Ashampoo Burning Studio 9.03
ATI - Software Uninstall Utility
ATI Display Driver
Audacity 1.2.6
AutoUpdate
AVG Free 9.0
Canon PIXMA iP3000
CD-LabelPrint
ConvertXtoDVD 3.3.4.106e
Corel Paint Shop Pro Photo X2
DivX Codec
Energy Saver Advance B9.0316.1
Eudora
FLV Player 2.0 (build 25)
Garmin City Navigator Australia 2008
Garmin City Navigator Europe NT 2008
Garmin Communicator Plugin
Garmin MapSource
Garmin Mobile PC
Garmin POI Loader
Garmin USB Drivers
Google Earth
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP PrecisionScan
Java Auto Updater
Java(TM) 6 Update 20
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.6.8)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 8 Essentials
neroxml
QuickTime
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
SmartSound Quicktracks Plugin
SpeedFan (remove only)
Ulead DVD DiskRecorder 2.1.1
Ulead VideoStudio 10
Ulead VideoStudio 9.0
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB898461)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VCRedistSetup
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
WIDCOMM Bluetooth Software
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Media Encoder 9 Series
WinRAR archiver

==== Event Viewer Messages From Past Week ========

8/13/2010 8:24:20 AM, error: ati2mtag [52225] - CPLIB :: Open Session - Failed to load the library
8/12/2010 5:28:58 PM, error: Service Control Manager [7000] - The ASPI32 service failed to start due to the following error: The system cannot find the file specified.

==== End Of File ===========================


DDS LOG

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/27/2010 10:20:59 PM
System Uptime: 8/17/2010 8:30:53 PM (0 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | EG41MF-US2H
Processor: Intel Pentium III Xeon processor | Socket 775 | 2933/266mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 98 GiB total, 82.139 GiB free.
D: is FIXED (NTFS) - 98 GiB total, 20.772 GiB free.
E: is FIXED (NTFS) - 137 GiB total, 64.611 GiB free.
F: is FIXED (NTFS) - 98 GiB total, 95.404 GiB free.
G: is FIXED (NTFS) - 36 GiB total, 18.679 GiB free.
H: is CDROM ()
I: is Removable
J: is CDROM (CDFS)
K: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP210: 8/15/2010 5:21:44 PM - System Checkpoint
RP211: 8/16/2010 4:39:37 PM - Restore Operation
RP212: 8/17/2010 5:41:57 PM - Avg Update

==== Installed Programs ======================

µTorrent
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.2.3
Arachnophilia version 4.0
Ashampoo Burning Studio 9.03
ATI - Software Uninstall Utility
ATI Display Driver
Audacity 1.2.6
AutoUpdate
AVG Free 9.0
Canon PIXMA iP3000
CD-LabelPrint
ConvertXtoDVD 3.3.4.106e
Corel Paint Shop Pro Photo X2
DivX Codec
Energy Saver Advance B9.0316.1
Eudora
FLV Player 2.0 (build 25)
Garmin City Navigator Australia 2008
Garmin City Navigator Europe NT 2008
Garmin Communicator Plugin
Garmin MapSource
Garmin Mobile PC
Garmin POI Loader
Garmin USB Drivers
Google Earth
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP PrecisionScan
Java Auto Updater
Java(TM) 6 Update 20
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.6.8)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 8 Essentials
neroxml
QuickTime
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
SmartSound Quicktracks Plugin
SpeedFan (remove only)
Ulead DVD DiskRecorder 2.1.1
Ulead VideoStudio 10
Ulead VideoStudio 9.0
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB898461)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VCRedistSetup
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
WIDCOMM Bluetooth Software
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Media Encoder 9 Series
WinRAR archiver

==== Event Viewer Messages From Past Week ========

8/13/2010 8:24:20 AM, error: ati2mtag [52225] - CPLIB :: Open Session - Failed to load the library
8/12/2010 5:28:58 PM, error: Service Control Manager [7000] - The ASPI32 service failed to start due to the following error: The system cannot find the file specified.

==== End Of File ===========================

 

Thanks Pete

I am aware of dangers of downloading from P2P however I usually only ever use this to download DOX and Mp3 files which I always scan using AVG (free version). Maybe the Malware came from some unscrupulous web site I recently visited.

I can safely say that all installed software has been paid for, is freeware or came off a magazine cover disk.

I am hopeful that someone can pinpoint where the problem is although looking at the logs I have found that I am missing ASPI32 from the System32>drivers folder.

For what it's worth I have noticed that when I attempted to go to the link to download DDS, Firefox displayed in the bottom 'bar' - Transferring data from p.brilig.com

 

Sorry Pete,
I thought that I had doubled checked that. I am in a bit of a 'tiz' as the other PC is upstairs and I am having to go up and down the stairs and getting tired and confused.

Here is the DDS file


DDS (Ver_10-03-17.01) - NTFSx86
Run by John at 20:55:40.85 on Tue 08/17/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1201 [GMT 10:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe
C:\WINDOWS\System32\regsvr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Qualcomm\Eudora\Eudora.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\John\Application Data\U3\00001862657503DE\LaunchPad.exe
K:\dds.scr

============== Pseudo HJT Report ===============

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: cashtitan browser enhancer: {c6e4c91a-bdcd-7ecd-42c0-3449027252a5} - c:\windows\system32\cjwsytgcrhbgi.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [Corel File Shell Monitor] c:\program files\corel\corel paint shop pro photo x2\CorelIOMonitor.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [UVS10 Preload] c:\program files\ulead systems\ulead videostudio 10\uvPL.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [HP Lamp] c:\program files\hewlett-packard\hp precisionscan\precisionscan\HPLamp.exe
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [dojzkhjjiijo] c:\windows\system32\regsvr32.exe /s "c:\windows\system32\cjwsytgcrhbgi.dll "
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\program files\qualcomm\eudora\EuShlExt.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\john\applic~1\mozilla\firefox\profiles\w70g2neu.default\
FF - prefs.js: browser.startup.homepage - file:///E:/Graphics/mypage.htm
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.buffer.cache.count ", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.buffer.cache.size ", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-8-17 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-2-28 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-2-28 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-28 243024]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-7-16 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-16 308136]
R2 GEST Service;GEST Service for program management.;c:\program files\gigabyte\energysaver\GSvr.exe [2010-2-27 68136]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-12 1355416]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-17 15008]

=============== Created Last 30 ================

2010-08-17 07:36:09 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-08-17 06:47:42 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-08-17 06:47:41 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-08-17 06:45:44 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-08-16 10:10:11 54156 ---ha-w- c:\windows\QTFont.qfn
2010-08-16 10:10:11 1409 ----a-w- c:\windows\QTFont.for
2010-08-16 09:48:11 89088 ----a-w- c:\windows\system32\ProgressBar4.ocx
2010-08-16 09:48:11 512688 ----a-w- c:\windows\system32\XceedCry.dll
2010-08-16 09:48:11 423784 ----a-w- c:\windows\system32\XceedBkp.dll
2010-08-16 09:48:11 389120 ----a-w- c:\windows\system32\ACTSKN43.OCX
2010-08-16 09:48:11 188416 ----a-w- c:\windows\system32\actsplash.ocx
2010-08-16 09:48:11 1435272 ----a-w- c:\windows\system32\Flash.ocx
2010-08-16 09:48:11 11012 ----a-w- c:\windows\system32\threadapi.tlb
2010-08-16 09:48:11 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2010-08-16 06:43:48 0 d-sh--w- c:\documents and settings\john\IECompatCache
2010-08-16 06:40:12 0 d-----w- c:\windows\system32\wbem\Repository
2010-08-15 04:40:12 0 d-----w- c:\program files\Microsoft Visual Studio 8
2010-08-15 04:39:42 0 d-----w- c:\windows\SHELLNEW
2010-08-15 01:51:12 87552 --sha-r- c:\windows\system32\comcat2.dll
2010-08-15 01:50:45 50400 ----a-w- c:\windows\system32\jpvxtgfukhcrdt.exe
2010-08-14 11:44:26 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-08-06 12:21:12 386560 ----a-w- c:\windows\system32\cjwsytgcrhbgi.dll
2010-08-05 08:45:39 0 d-----w- c:\program files\MSECache
2010-08-04 08:27:21 87608 ----a-w- c:\docume~1\john\applic~1\inst.exe
2010-08-04 08:27:21 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-08-04 08:27:21 47360 ----a-w- c:\docume~1\john\applic~1\pcouffin.sys
2010-08-04 08:27:17 65602 ----a-w- c:\windows\system32\cook3260.dll
2010-08-04 08:27:17 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2010-08-04 08:27:17 217127 ----a-w- c:\windows\system32\drv43260.dll
2010-08-04 08:27:17 208935 ----a-w- c:\windows\system32\drv33260.dll
2010-08-04 08:27:17 176165 ----a-w- c:\windows\system32\drv23260.dll
2010-08-04 08:27:17 102439 ----a-w- c:\windows\system32\sipr3260.dll
2010-08-04 08:27:16 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2010-08-04 08:27:15 0 d-----w- c:\program files\VSO
2010-08-01 06:37:10 0 ----a-w- c:\windows\iplayer.INI
2010-07-31 02:10:04 0 dc----w- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2010-07-31 02:09:59 0 d-----w- c:\program files\Lavasoft
2010-07-28 07:32:40 0 dc----w- c:\docume~1\alluse~1\applic~1\{92E7A367-8E12-4830-AA70-29C32E331A81}
2010-07-24 08:11:04 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-07-19 11:47:43 754 ----a-w- c:\windows\WORDPAD.INI

==================== Find3M ====================

2010-08-17 10:31:25 17488 ----a-w- c:\windows\gdrv.sys
2010-08-16 10:10:06 848 --sha-w- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2010-08-06 12:22:36 31560 ----a-w- c:\docume~1\john\applic~1\GDIPFONTCACHEV1.DAT
2010-07-15 23:00:18 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 23:00:17 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-15 22:59:53 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27:11 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-02-27 11:22:05 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012010022720100228\index.dat

============= FINISH: 20:56:02.12 ===============

 

Thanks
I followed the instructions exactly.
Here are the results.
RKILL
Downloaded and ran ok but it didn't display that it found anything (not sure if it was supposed to).
It did NOT instruct me to reboot.
MBAM
Downloaded, installed and ran as instructed
It found and downloaded the latest version
Her is the log

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4443

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/18/2010 4:18:18 PM
mbam-log-2010-08-18 (16-18-18).txt

Scan type: Quick scan
Objects scanned: 155945
Time elapsed: 8 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 5
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\cjwsytgcrhbgi.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{c6e4c91a-bdcd-7ecd-42c0-3449027252a5} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{c6e4c91a-bdcd-7ecd-42c0-3449027252a5} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c6e4c91a-bdcd-7ecd-42c0-3449027252a5} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c6e4c91a-bdcd-7ecd-42c0-3449027252a5} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Malware Sweeper (Rogue.MalwareSweeper) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dojzkhjjiijo (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\cjwsytgcrhbgi.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\Acrobat Update.job (Malware.Trace) -> Quarantined and deleted successfully.

GMER
Downloaded, selected Rootkit tab, did NOT uncheck "Devices "

Here comes a problem!
I let it run for over 2.5 hours and it was still going. I could have reformted and installed everything again in that time!
I saved the log at that point.
Tried to exit but had NO control over my PC and eventually resorted to a COLD boot.

Here is what is in the log when I cold booted

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-18 16:46:43
Windows 5.1.2600 Service Pack 3
Running: m458cms6.exe; Driver: C:\DOCUME~1\John\LOCALS~1\Temp\kwloifob.sys


---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xBA11887E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xBA118BFE]

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB9089000, 0x1BDE76, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 011CBAAE
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 011CC7B5
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] WS2_32.dll!send 71AB4C27 5 Bytes JMP 011CC4C9
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 011CC6D1
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 011CB9F4
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] WS2_32.dll!recv 71AB676F 5 Bytes JMP 011CC56C
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 011CC613
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] WS2_32.dll!WSAAsyncGetHostByName 71ABE99D 5 Bytes JMP 011CBE12
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] GDI32.dll!TextOutW 77F17EAC 5 Bytes JMP 011CCA15
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] GDI32.dll!ExtTextOutW 77F18086 5 Bytes JMP 011CCF3D
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] GDI32.dll!TextOutA 77F1BA4F 5 Bytes JMP 011CC94B
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] GDI32.dll!ExtTextOutA 77F1D3FA 5 Bytes JMP 011CCE5B
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] GDI32.dll!GetGlyphIndicesA 77F3DFE3 5 Bytes JMP 011CD2E8
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] GDI32.dll!GetGlyphIndicesW 77F52604 5 Bytes JMP 011CD3AF
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 011CBEEA
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] USER32.dll!DrawTextExW 7E42B415 5 Bytes JMP 011CCD76
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] USER32.dll!DrawTextW 7E42D7E2 5 Bytes JMP 011CCBB8
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] USER32.dll!SetClipboardData 7E430F9E 5 Bytes JMP 011CC840
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] USER32.dll!DrawTextA 7E43C702 5 Bytes JMP 011CCADF
.text C:\Program Files\Mozilla Firefox\firefox.exe[3116] USER32.dll!DrawTextExA 7E43C739 5 Bytes JMP 011CCC91

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)


What now? Should I disable AVG, AdAware, anything else?

 

Here is the contents of MBRCHECK

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000001fd

Kernel Drivers (total 131):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA0B8000 ohci1394.sys
0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0D8000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0E8000 VolSnap.sys
0xB9F0B000 atapi.sys
0xBA0F8000 disk.sys
0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9EEB000 fltMgr.sys
0xB9ED9000 sr.sys
0xBA118000 Lbd.sys
0xB9EC2000 KSecDD.sys
0xB9E35000 Ntfs.sys
0xB9E08000 NDIS.sys
0xBA5AE000 speedfan.sys
0xB9DEE000 Mup.sys
0xBA671000 giveio.sys
0xBA2B8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB95C1000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xB95AD000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB9585000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB9568000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys
0xBA3B0000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB9544000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA3B8000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA2C8000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xBA3C0000 \SystemRoot\system32\DRIVERS\fdc.sys
0xBA2D8000 \SystemRoot\system32\DRIVERS\serial.sys
0xB9DBA000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA2E8000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA308000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB9521000 \SystemRoot\system32\DRIVERS\ks.sys
0xB9450000 \SystemRoot\system32\DRIVERS\btkrnl.sys
0xBA6F6000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA318000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB9DB2000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB9439000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA148000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA158000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA3C8000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB9428000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA168000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA3D0000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA3D8000 \SystemRoot\system32\DRIVERS\raspti.sys
0xBA178000 \SystemRoot\System32\Drivers\pcouffin.sys
0xB9358000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA188000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA3E0000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA3E8000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5CA000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB92FA000 \SystemRoot\system32\DRIVERS\update.sys
0xB9979000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA3F8000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xBA400000 \SystemRoot\system32\DRIVERS\btport.sys
0xBA1A8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xAD260000 \SystemRoot\system32\drivers\AtiHdmi.sys
0xAD23C000 \SystemRoot\system32\drivers\portcls.sys
0xBA1D8000 \SystemRoot\system32\drivers\drmk.sys
0xACD47000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xBA208000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5D4000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xBA5D6000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA780000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5D8000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA418000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA420000 \SystemRoot\System32\drivers\vga.sys
0xBA5DA000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5DC000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA428000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA430000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA598000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xACC9B000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xACC42000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xACC08000 \SystemRoot\System32\Drivers\avgtdix.sys
0xABD3F000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA258000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xBA438000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xBA268000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xABD17000 \SystemRoot\system32\DRIVERS\netbt.sys
0xABCF5000 \SystemRoot\System32\drivers\afd.sys
0xBA278000 \SystemRoot\system32\DRIVERS\netbios.sys
0xABC2A000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xABBBA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA288000 \SystemRoot\System32\Drivers\Fips.SYS
0xBA440000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xABB86000 \SystemRoot\System32\Drivers\avgldx86.sys
0xB92B5000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA298000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA448000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xBA450000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xB92A9000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xB92A5000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xB929D000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xABB3A000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xABB22000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA648000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xABB6A000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA490000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA787000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF065000 \SystemRoot\System32\ati2cqag.dll
0xBF0FE000 \SystemRoot\System32\atikvmag.dll
0xBF181000 \SystemRoot\System32\atiok3x2.dll
0xBF1CC000 \SystemRoot\System32\ati3duag.dll
0xBF9C5000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xA97F5000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9344000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xA923F000 \SystemRoot\system32\drivers\wdmaud.sys
0xA92FC000 \SystemRoot\system32\drivers\sysaudio.sys
0xA9082000 \SystemRoot\system32\DRIVERS\srv.sys
0xA8CC8000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA88E7000 \SystemRoot\System32\Drivers\HTTP.sys
0xA8A1C000 \??\C:\WINDOWS\gdrv.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 49):
0 System Idle Process
4 System
660 C:\WINDOWS\system32\smss.exe
728 csrss.exe
760 C:\WINDOWS\system32\winlogon.exe
804 C:\WINDOWS\system32\services.exe
816 C:\WINDOWS\system32\lsass.exe
984 C:\WINDOWS\system32\ati2evxx.exe
1004 C:\WINDOWS\system32\svchost.exe
1072 svchost.exe
1176 C:\WINDOWS\system32\svchost.exe
1200 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
1300 svchost.exe
1368 svchost.exe
1412 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1476 C:\WINDOWS\system32\ati2evxx.exe
1484 C:\Program Files\AVG\AVG9\avgchsvx.exe
1492 C:\Program Files\AVG\AVG9\avgrsx.exe
1620 C:\Program Files\AVG\AVG9\avgcsrvx.exe
1708 C:\WINDOWS\system32\spoolsv.exe
1724 C:\WINDOWS\system32\rundll32.exe
484 svchost.exe
528 C:\Program Files\AVG\AVG9\avgwdsvc.exe
580 C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
1128 C:\WINDOWS\explorer.exe
1168 C:\Program Files\Java\jre6\bin\jqs.exe
1508 C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
2060 C:\WINDOWS\system32\svchost.exe
2144 C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
2256 C:\WINDOWS\RTHDCPL.EXE
2280 C:\PROGRA~1\AVG\AVG9\avgtray.exe
2292 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
2308 C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
2320 C:\Program Files\QuickTime\qttask.exe
2344 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2352 C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe
2376 C:\WINDOWS\system32\ctfmon.exe
2400 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
2584 C:\WINDOWS\system32\wuauclt.exe
2916 C:\Program Files\AVG\AVG9\avgemc.exe
2984 C:\Program Files\AVG\AVG9\avgnsx.exe
3016 C:\Program Files\AVG\AVG9\avgcsrvx.exe
3440 unsecapp.exe
3616 wmiprvse.exe
3752 alg.exe
4020 C:\Program Files\Qualcomm\Eudora\Eudora.exe
2724 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
3240 C:\Program Files\Mozilla Firefox\firefox.exe
716 E:\INTERNET\downloads_new\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000018`69e61600 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000030`d3cbae00 (NTFS)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000053`018d9c00 (NTFS)
\\.\G: --> \\.\PhysicalDrive0 at offset 0x0000006b`6b733400 (NTFS)

PhysicalDrive0 Model Number: ST3500418AS, Rev: CC35

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

Now that you have suggested that GMER could take a long long time I will run it again if required - I will run it overnight and let it run for 8+ hours (or whatever you suggest). TH\he first time I ran it I considered the PC had HUNG after 2.5 hours especially when I could not do anything else (even CTRL-SHIFT - DELETE had no effect).
If you suggest that I run it again please advise if I should disable AVG and Ad-Aware (other processes in my task bar are QuickTime, RealTek HD Audio Manager, Safely Remove Hardware, Java Update Available and Bluetooth should I disable those too?).
Also should I disable DEVICES (tab) when (re)running GMER?

Lastly I have had no further instances of CashTitan popping up advertising scratch for cash (or anything else) since running MBAM.

 

Here is the log

ComboFix 10-08-18.04 - John 08/20/2010 9:12.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1464 [GMT 10:00]
Running from: e:\internet\downloads_new\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\John\Application Data\inst.exe
c:\windows\AUTOLNCH.REG

.
((((((((((((((((((((((((( Files Created from 2010-07-19 to 2010-08-19 )))))))))))))))))))))))))))))))
.

2010-08-18 06:08 . 2010-08-18 06:08 -------- d-----w- c:\documents and settings\John\Application Data\Malwarebytes
2010-08-18 06:08 . 2010-04-29 05:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-18 06:08 . 2010-08-18 06:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-18 06:08 . 2010-08-18 06:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-18 06:08 . 2010-04-29 05:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-17 07:36 . 2010-07-12 08:55 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-08-17 06:47 . 2010-07-12 08:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-08-17 06:47 . 2010-08-17 06:47 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-08-17 06:46 . 2010-08-17 06:46 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Sunbelt Software
2010-08-17 06:45 . 2010-08-17 06:45 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-08-17 06:45 . 2010-07-12 08:56 2979280 -c--a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe
2010-08-17 06:08 . 2010-08-17 06:08 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Threat Expert
2010-08-16 11:52 . 2010-08-17 06:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-16 09:48 . 2004-05-11 00:56 423784 ----a-w- c:\windows\system32\XceedBkp.dll
2010-08-16 09:48 . 2003-11-19 04:59 512688 ----a-w- c:\windows\system32\XceedCry.dll
2010-08-16 09:48 . 2000-07-14 20:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2010-08-16 06:43 . 2010-08-16 06:43 -------- d-sh--w- c:\documents and settings\John\IECompatCache
2010-08-16 06:40 . 2010-08-16 06:40 -------- d-----w- c:\windows\system32\wbem\Repository
2010-08-16 06:15 . 2010-08-16 06:15 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Ashampoo
2010-08-15 04:41 . 2010-08-15 04:41 -------- d-----w- c:\program files\Microsoft Works
2010-08-15 04:41 . 2010-08-15 04:41 -------- d-----w- c:\program files\Microsoft.NET
2010-08-15 04:40 . 2010-08-15 04:40 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-08-15 04:39 . 2010-08-15 04:39 -------- d-----w- c:\windows\SHELLNEW
2010-08-15 04:39 . 2010-08-15 04:39 -------- d-----r- C:\MSOCache
2010-08-15 01:51 . 2010-08-15 01:51 87552 --sha-r- c:\windows\system32\comcat2.dll
2010-08-15 01:50 . 2010-08-15 01:50 50400 ----a-w- c:\windows\system32\jpvxtgfukhcrdt.exe
2010-08-14 11:44 . 2006-10-26 09:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-08-14 11:44 . 2006-10-26 09:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-08-10 06:07 . 2010-08-10 06:07 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Microsoft Help
2010-08-10 06:07 . 2010-08-15 04:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-09 09:18 . 2010-08-09 09:18 12800 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3be5af51-n\decora-d3d.dll
2010-08-09 09:18 . 2010-08-09 09:18 61440 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3be5af51-n\decora-sse.dll
2010-08-09 09:18 . 2010-08-09 09:18 503808 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6e3699d8-n\msvcp71.dll
2010-08-09 09:18 . 2010-08-09 09:18 499712 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6e3699d8-n\jmc.dll
2010-08-09 09:18 . 2010-08-09 09:18 348160 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6e3699d8-n\msvcr71.dll
2010-08-05 08:45 . 2010-08-05 08:45 -------- d-----w- c:\program files\MSECache
2010-08-04 08:27 . 2010-08-04 08:27 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-08-04 08:27 . 2010-08-04 08:27 47360 ----a-w- c:\documents and settings\John\Application Data\pcouffin.sys
2010-08-04 08:27 . 2010-08-12 21:59 -------- d-----w- c:\documents and settings\John\Application Data\Vso
2010-08-04 08:27 . 2007-03-18 10:37 65602 ----a-w- c:\windows\system32\cook3260.dll
2010-08-04 08:27 . 2006-09-29 02:26 176165 ----a-w- c:\windows\system32\drv23260.dll
2010-08-04 08:27 . 2006-09-29 02:25 208935 ----a-w- c:\windows\system32\drv33260.dll
2010-08-04 08:27 . 2006-09-29 02:24 217127 ----a-w- c:\windows\system32\drv43260.dll
2010-08-04 08:27 . 2006-05-11 09:21 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2010-08-04 08:27 . 2002-12-09 16:20 102439 ----a-w- c:\windows\system32\sipr3260.dll
2010-08-04 08:27 . 2006-05-20 06:16 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2010-08-04 08:27 . 2010-08-04 08:27 -------- d-----w- c:\program files\VSO
2010-07-31 02:10 . 2010-07-31 06:21 -------- dc----w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2010-07-31 02:09 . 2010-08-16 09:09 -------- d-----w- c:\program files\Lavasoft
2010-07-31 02:09 . 2010-08-16 06:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-30 22:43 . 2010-07-30 22:43 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-07-28 07:32 . 2010-07-28 07:32 -------- dc----w- c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2010-07-24 12:01 . 2010-07-24 12:01 61440 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-16723bdb-n\decora-sse.dll
2010-07-24 08:10 . 2010-07-24 08:11 -------- d-s---w- c:\documents and settings\Pat\Local Settings\Application Data\Microsoft
2010-07-23 08:47 . 2006-12-14 00:00 110592 ----a-w- c:\documents and settings\John\Application Data\U3\temp\cleanup.exe
2010-07-23 08:47 . 2007-02-12 07:46 3096576 ---ha-w- c:\documents and settings\John\Application Data\U3\temp\Launchpad Removal.exe
2010-07-23 08:47 . 2010-08-17 12:23 -------- d-----w- c:\documents and settings\John\Application Data\U3
2010-07-21 06:04 . 2010-07-21 06:04 921440 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgemc.exe
2010-07-21 06:04 . 2010-07-21 06:04 1615200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
2010-07-21 06:04 . 2010-07-21 06:04 1107296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
2010-07-21 06:04 . 2010-07-21 06:04 4368224 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-19 23:10 . 2010-02-27 11:33 17488 ----a-w- c:\windows\gdrv.sys
2010-08-19 22:20 . 2010-07-06 02:04 -------- d-----w- c:\program files\SpeedFan
2010-08-18 06:32 . 2010-02-28 05:36 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-08-16 20:42 . 2010-03-02 10:45 -------- d-----w- c:\documents and settings\John\Application Data\uTorrent
2010-08-16 10:10 . 2010-03-04 05:47 848 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-08-16 10:10 . 2010-03-04 05:47 848 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-08-16 06:39 . 2010-03-22 09:49 -------- d-----w- c:\program files\Ashampoo
2010-08-15 04:48 . 2010-02-27 11:45 57080 ----a-w- c:\documents and settings\John\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-15 04:41 . 2010-02-28 19:57 -------- d-----w- c:\program files\MSBuild
2010-08-14 22:49 . 2010-04-26 02:18 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-27 07:28 . 2010-03-01 08:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Ulead Systems
2010-07-24 12:01 . 2010-07-24 12:01 503808 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-23526d38-n\msvcp71.dll
2010-07-24 12:01 . 2010-07-24 12:01 499712 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-23526d38-n\jmc.dll
2010-07-24 12:01 . 2010-07-24 12:01 348160 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-23526d38-n\msvcr71.dll
2010-07-24 12:01 . 2010-07-24 12:01 12800 ----a-w- c:\documents and settings\Pat\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-16723bdb-n\decora-d3d.dll
2010-07-24 08:11 . 2010-07-24 08:11 -------- d-----w- c:\documents and settings\Pat\Application Data\Ulead Systems
2010-07-17 08:47 . 2010-07-17 08:47 503808 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-12417a63-n\msvcp71.dll
2010-07-17 08:47 . 2010-07-17 08:47 499712 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-12417a63-n\jmc.dll
2010-07-17 08:47 . 2010-07-17 08:47 348160 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-12417a63-n\msvcr71.dll
2010-07-17 08:47 . 2010-07-17 08:47 61440 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-46028758-n\decora-sse.dll
2010-07-17 08:47 . 2010-07-17 08:47 12800 ----a-w- c:\documents and settings\Visitor\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-46028758-n\decora-d3d.dll
2010-07-15 23:00 . 2010-02-28 05:38 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 23:00 . 2010-07-15 23:00 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-15 22:59 . 2010-02-28 05:38 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-09 01:12 . 2010-07-09 01:12 -------- d-----w- c:\program files\FLV Player
2010-06-30 12:31 . 2008-04-14 08:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-30 11:02 . 2010-06-30 11:02 -------- d-----w- c:\program files\FS Design Tools
2010-06-24 12:22 . 2008-04-23 00:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2008-04-14 08:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-22 07:59 . 2010-06-22 07:59 -------- d-----w- c:\documents and settings\John\Application Data\Nero
2010-06-22 07:54 . 2010-06-22 07:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-06-22 07:54 . 2010-04-12 11:01 -------- d-----w- c:\program files\Common Files\Nero
2010-06-21 15:27 . 2008-04-14 08:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2008-04-14 08:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2010-02-27 11:17 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2008-04-14 08:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-03 06:14 . 2010-02-28 05:38 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-24 02:18 . 2010-05-24 02:18 503808 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-328723bd-n\msvcp71.dll
2010-05-24 02:18 . 2010-05-24 02:18 499712 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-328723bd-n\jmc.dll
2010-05-24 02:18 . 2010-05-24 02:18 348160 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-328723bd-n\msvcr71.dll
2010-05-24 02:18 . 2010-05-24 02:18 61440 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5d49d2aa-n\decora-sse.dll
2010-05-24 02:18 . 2010-05-24 02:18 12800 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5d49d2aa-n\decora-d3d.dll
.

------- Sigcheck -------

[-] 2008-07-12 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C} "= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-04-19 00:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829} "= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829} "= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL "= "RTHDCPL.EXE" [2009-01-13 18084864]
"AVG9_TRAY "= "c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-06-17 40368]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Corel File Shell Monitor "= "c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-08-08 16712]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-04-14 155648]
"UVS10 Preload "= "c:\program files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe" [2006-03-06 36864]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HP Lamp "= "c:\program files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe" [1998-11-23 42496]
"NeroFilterCheck "= "c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2 "= "shell32" [X]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-12-6 576104]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8} "= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2005-08-09 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 23:00 12536 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe "=
"c:\\Program Files\\uTorrent\\utorrent.exe "=
"c:\\WINDOWS\\system32\\dpvsetup.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/17/2010 4:47 PM 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/28/2010 3:38 PM 216400]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/28/2010 3:38 PM 243024]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/16/2010 8:59 AM 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/16/2010 9:00 AM 308136]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [2/27/2010 9:26 PM 68136]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 6:55 PM 1355416]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/17/2010 4:47 PM 15008]
.
Contents of the 'Scheduled Tasks' folder

2010-08-17 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 06:47]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\John\Application Data\Mozilla\Firefox\Profiles\w70g2neu.default\
FF - prefs.js: browser.startup.homepage - file:///E:/Graphics/mypage.htm
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.buffer.cache.count ", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.buffer.cache.size ", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-08-20 09:16:03
ComboFix-quarantined-files.txt 2010-08-19 23:16

Pre-Run: 88,078,528,512 bytes free
Post-Run: 89,964,367,872 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - EC62B9DC55473B6DACA968E7E41FA10A


BTW my default web browser has been changed from Firefox to IE8 is that correct? Is it ok to set it back?