Okay - I have run ComboFix, Malwarebytes and Hijack this (again, correctly) and here are the logs. Please let me know what to do next - I will be out for several hours and will check back then - thanks
ComboFix 09-11-07.03 - Dan 11/08/2009 9:42.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.261 [GMT -5:00]
Running from: c:\my downloads\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NDISRD
((((((((((((((((((((((((( Files Created from 2009-10-08 to 2009-11-08 )))))))))))))))))))))))))))))))
.
2009-11-08 01:40 . 2009-11-03 01:42 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-11-07 19:06 . 2009-11-07 19:06 117760 ----a-w- c:\documents and settings\Dan\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-07 19:06 . 2009-11-07 19:06 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-07 19:05 . 2009-11-07 19:06 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-07 19:05 . 2009-11-07 19:05 -------- d-----w- c:\documents and settings\Dan\Application Data\SUPERAntiSpyware.com
2009-11-07 19:05 . 2009-11-07 19:05 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-11-07 18:34 . 2009-11-07 18:34 -------- d-----w- C:\VundoFix Backups
2009-11-06 01:35 . 2009-11-06 01:35 -------- d-----w- c:\documents and settings\Dan\Application Data\Malwarebytes
2009-11-06 01:35 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-06 01:35 . 2009-11-06 01:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-06 01:35 . 2009-11-06 01:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-06 01:35 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-05 02:53 . 2009-11-05 02:53 3584 ----a-r- c:\documents and settings\Dan\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-11-05 02:53 . 2009-11-05 02:53 -------- d-----w- c:\program files\Windows Installer Clean Up
2009-11-02 01:54 . 2009-11-03 02:46 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8ls
2009-10-17 18:47 . 2009-10-17 18:47 -------- d-----w- c:\documents and settings\Dan\Application Data\Unity
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-08 00:50 . 2009-09-16 23:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Nanovor
2009-11-05 02:53 . 2008-12-03 04:04 -------- d-----w- c:\program files\MSECache
2009-11-02 02:20 . 2009-05-07 22:44 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-01 12:21 . 2009-05-10 16:41 38 ----a-w- c:\documents and settings\Dan\jagex_runescape_preferences.dat
2009-11-01 12:20 . 2009-09-06 00:49 63 ----a-w- c:\documents and settings\Dan\jagex_runescape_preferences2.dat
2009-10-31 00:46 . 2009-09-25 16:39 581632 ----a-w- c:\documents and settings\All Users\Application Data\Nanovor\Utils\ConsoleDeviceInterface.exe
2009-10-31 00:41 . 2009-09-25 14:19 5940832 ----a-w- c:\documents and settings\All Users\Application Data\Nanovor\evolver.exe
2009-10-23 14:00 . 2008-01-09 02:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-09 22:33 . 2005-08-24 16:21 84080 -c--a-w- c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-02-05 03:18 . 2008-02-05 03:18 774144 ----a-w- c:\program files\RngInterstitial.dll
2005-08-29 01:14 . 2005-08-29 01:14 563 -c--a-w- c:\program files\list.tmp
.
------- Sigcheck -------
[7] 2008-10-16 . E654B78D2F1D791B30D0ED9A8195EC22 . 51224 . . [7.2.6001.788] . . c:\windows\system32\dllcache\wuauclt.exe
[-] 2008-04-14 . ED7262E52C31CF1625B65039102BC16C . 111104 . . [5.4.3790.5512] . . c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\wuauclt.exe
c:\windows\system32\wuauclt.exe ... is missing !!
.
((((((((((((((((((((((((((((( SnapShot@2009-11-06_01.18.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-07 19:06 . 2009-11-07 19:06 65024 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2009-11-07 19:06 . 2009-11-07 19:06 18944 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2009-11-07 19:06 . 2009-11-07 19:06 5120 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe
+ 2009-11-08 01:35 . 2009-11-08 01:35 301056 c:\windows\Installer\135c7ac.msi
+ 2009-11-07 19:06 . 2009-11-07 19:06 1583616 c:\windows\Installer\d16200.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-13 2000112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-07-05 98304]
"Net-It Launcher"="c:\windows\system32\NILaunch.exe" [1998-02-05 24576]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"MsgCenterExe"="c:\program files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" [2009-01-11 69632]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-11 185872]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe [2005-3-10 757760]
Kodak software updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]
Quicken Online Backup TaskBar Icon.LNK - c:\program files\Quicken Online Backup\CBSysTray.exe [2007-7-9 114688]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare Software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 9:24 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 9:24 PM 74480]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/16/2007 1:08 PM 24652]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 9:24 PM 7408]
R3 slnt;Real RTL8139 PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [6/23/2008 12:54 PM 18004]
S3 EraserUtilDrv10720;EraserUtilDrv10720;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10720.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10720.sys [?]
--- Other Services/Drivers In Memory ---
*Deregistered* - mbr
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: &eBay Search - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-11-08 09:55
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(416)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
- - - - - - - > 'explorer.exe'(2536)
c:\program files\ScanSoft\OmniPageSE2.0\ophookSE2.dll
c:\windows\system32\browselc.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\brss01a.exe
c:\program files\Quicken Online Backup\AgentSrv.EXE
c:\windows\system32\drivers\KodakCCS.exe
c:\windows\system32\wscntfy.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\Java\jre1.6.0_07\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-11-08 10:07 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-08 15:05
ComboFix2.txt 2009-11-06 01:28
Pre-Run: 14,499,090,432 bytes free
Post-Run: 14,510,338,048 bytes free
- - End Of File - - 17A19A3F6E308256F3199610B371C748