PCTech Forums

Thank you in advance for any help

file of HijackThis v1.99.1
Scan saved at 5:42:35 PM, on 5/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://m.www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: UrlSearchHook Class -

{00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program

Files\Ask.com\GenericAskToolbar.dll
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 94.75.207.107 www.google.com
O1 - Hosts: 94.75.207.107 google.com
O1 - Hosts: 94.75.207.107 google.com.au
O1 - Hosts: 94.75.207.107 www.google.com.au
O1 - Hosts: 94.75.207.107 google.be
O1 - Hosts: 94.75.207.107 www.google.be
O1 - Hosts: 94.75.207.107 google.com.br
O1 - Hosts: 94.75.207.107 www.google.com.br
O1 - Hosts: 94.75.207.107 google.ca
O1 - Hosts: 94.75.207.107 www.google.ca
O1 - Hosts: 94.75.207.107 google.ch
O1 - Hosts: 94.75.207.107 www.google.ch
O1 - Hosts: 94.75.207.107 google.de
O1 - Hosts: 94.75.207.107 www.google.de
O1 - Hosts: 94.75.207.107 google.dk
O1 - Hosts: 94.75.207.107 www.google.dk
O1 - Hosts: 94.75.207.107 google.fr
O1 - Hosts: 94.75.207.107 www.google.fr
O1 - Hosts: 94.75.207.107 google.ie
O1 - Hosts: 94.75.207.107 www.google.ie
O1 - Hosts: 94.75.207.107 google.it
O1 - Hosts: 94.75.207.107 www.google.it
O1 - Hosts: 94.75.207.107 google.co.jp
O1 - Hosts: 94.75.207.107 www.google.co.jp
O1 - Hosts: 94.75.207.107 google.nl
O1 - Hosts: 94.75.207.107 www.google.nl
O1 - Hosts: 94.75.207.107 google.no
O1 - Hosts: 94.75.207.107 www.google.no
O1 - Hosts: 94.75.207.107 google.co.nz
O1 - Hosts: 94.75.207.107 www.google.co.nz
O1 - Hosts: 94.75.207.107 google.pl
O1 - Hosts: 94.75.207.107 www.google.pl
O1 - Hosts: 94.75.207.107 google.se
O1 - Hosts: 94.75.207.107 www.google.se
O1 - Hosts: 94.75.207.107 google.co.uk
O1 - Hosts: 94.75.207.107 www.google.co.uk
O1 - Hosts: 94.75.207.107 google.co.za
O1 - Hosts: 94.75.207.107 www.google.co.za
O1 - Hosts: 94.75.207.107 www.google-analytics.com
O1 - Hosts: 94.75.207.107 www.bing.com
O1 - Hosts: 94.75.207.107 search.yahoo.com
O1 - Hosts: 94.75.207.107 www.search.yahoo.com
O1 - Hosts: 94.75.207.107 uk.search.yahoo.com
O1 - Hosts: 94.75.207.107 ca.search.yahoo.com
O1 - Hosts: 94.75.207.107 de.search.yahoo.com
O1 - Hosts: 94.75.207.107 fr.search.yahoo.com
O1 - Hosts: 94.75.207.107 au.search.yahoo.com
O2 - BHO: Spybot-S&D IE Protection -

{53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search

& Destroy\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper -

{68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program

Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} -

C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} -

C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} -

C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [MSConfig]

C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Search - ?p=ZCxdm492YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

%windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network

Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll

(file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} -

C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common

Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program

Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Unknown owner

- C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program

Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program

Files\Lavasoft\Ad-Aware\AAWService.exe

Hi mithril,

Please download to your desktop.

Double click combofix.exe and follow the prompts.

If combofix will not start or is ended before the "Blue window" please rename combofix.exe to cbf.exe and try again.

If cbf.exe will not start or is ended, you will have to run cbf.exe from safe mode.
Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Do not exit Combofix while it is running you my loose all your personal settings!
Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall.

When it's done running it will produce a log for you. Please post that log in your next reply.

Thank you Gecko... here is the combofix log:

ComboFix 10-05-03.03 - Nikki 05/03/2010 17:14:17.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.250 [GMT -4:00]
Running from: c:\documents and settings\Nikki\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\1fdbdf0
c:\documents and settings\All Users\Application Data\1fdbdf0\71.mof
c:\documents and settings\All Users\Application Data\1fdbdf0\BackUp\LimeWire On Startup.lnk
c:\documents and settings\All Users\Application Data\1fdbdf0\MS1fdb.exe
c:\documents and settings\All Users\Application Data\1fdbdf0\MSW.ico
c:\documents and settings\All Users\Application Data\1fdbdf0\MSWSys\vd952342.bd
c:\documents and settings\Nikki\Application Data\My Security Wall
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\1v75xp34.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\44JamwDje.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\4vf5bN2H6.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\62JrF.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\6I5STwvgJ.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\6KIHoI.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\6N8B3p.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\e42aU2.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\kRow2xC6.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\N1sf36Sq6.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\NjbQ38lv.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\ORH74N.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\QA0qR6gnN.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\qETJY3wSh.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\sB7A1rj5.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\SO4NN.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\sVt3G1F.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\WEd0hw.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\XuI63.jpg
c:\documents and settings\Nikki\Local Settings\Temporary Internet Files\yKH4jw3Y.jpg
c:\documents and settings\Nikki\Recent\ANTIGEN.dll
c:\documents and settings\Nikki\Recent\ANTIGEN.drv
c:\documents and settings\Nikki\Recent\ANTIGEN.exe
c:\documents and settings\Nikki\Recent\ANTIGEN.sys
c:\documents and settings\Nikki\Recent\ANTIGEN.tmp
c:\documents and settings\Nikki\Recent\cb.dll
c:\documents and settings\Nikki\Recent\cb.drv
c:\documents and settings\Nikki\Recent\cb.exe
c:\documents and settings\Nikki\Recent\cb.sys
c:\documents and settings\Nikki\Recent\cb.tmp
c:\documents and settings\Nikki\Recent\cid.exe
c:\documents and settings\Nikki\Recent\cid.sys
c:\documents and settings\Nikki\Recent\CLSV.dll
c:\documents and settings\Nikki\Recent\CLSV.drv
c:\documents and settings\Nikki\Recent\CLSV.exe
c:\documents and settings\Nikki\Recent\CLSV.sys
c:\documents and settings\Nikki\Recent\CLSV.tmp
c:\documents and settings\Nikki\Recent\DBOLE.dll
c:\documents and settings\Nikki\Recent\DBOLE.drv
c:\documents and settings\Nikki\Recent\DBOLE.tmp
c:\documents and settings\Nikki\Recent\ddv.exe
c:\documents and settings\Nikki\Recent\ddv.sys
c:\documents and settings\Nikki\Recent\delfile.dll
c:\documents and settings\Nikki\Recent\delfile.drv
c:\documents and settings\Nikki\Recent\delfile.exe
c:\documents and settings\Nikki\Recent\delfile.sys
c:\documents and settings\Nikki\Recent\delfile.tmp
c:\documents and settings\Nikki\Recent\dudl.dll
c:\documents and settings\Nikki\Recent\dudl.tmp
c:\documents and settings\Nikki\Recent\eb.dll
c:\documents and settings\Nikki\Recent\eb.drv
c:\documents and settings\Nikki\Recent\eb.exe
c:\documents and settings\Nikki\Recent\eb.sys
c:\documents and settings\Nikki\Recent\eb.tmp
c:\documents and settings\Nikki\Recent\energy.dll
c:\documents and settings\Nikki\Recent\energy.drv
c:\documents and settings\Nikki\Recent\energy.exe
c:\documents and settings\Nikki\Recent\energy.sys
c:\documents and settings\Nikki\Recent\energy.tmp
c:\documents and settings\Nikki\Recent\exec.dll
c:\documents and settings\Nikki\Recent\exec.drv
c:\documents and settings\Nikki\Recent\exec.exe
c:\documents and settings\Nikki\Recent\exec.sys
c:\documents and settings\Nikki\Recent\exec.tmp
c:\documents and settings\Nikki\Recent\fan.dll
c:\documents and settings\Nikki\Recent\fan.drv
c:\documents and settings\Nikki\Recent\fan.tmp
c:\documents and settings\Nikki\Recent\fix.dll
c:\documents and settings\Nikki\Recent\fix.drv
c:\documents and settings\Nikki\Recent\fix.exe
c:\documents and settings\Nikki\Recent\fix.sys
c:\documents and settings\Nikki\Recent\fix.tmp
c:\documents and settings\Nikki\Recent\FS.dll
c:\documents and settings\Nikki\Recent\FS.tmp
c:\documents and settings\Nikki\Recent\FW.dll
c:\documents and settings\Nikki\Recent\FW.drv
c:\documents and settings\Nikki\Recent\FW.sys
c:\documents and settings\Nikki\Recent\gid.dll
c:\documents and settings\Nikki\Recent\gid.tmp
c:\documents and settings\Nikki\Recent\grid.dll
c:\documents and settings\Nikki\Recent\grid.tmp
c:\documents and settings\Nikki\Recent\hymt.drv
c:\documents and settings\Nikki\Recent\hymt.exe
c:\documents and settings\Nikki\Recent\hymt.sys
c:\documents and settings\Nikki\Recent\hymt.tmp
c:\documents and settings\Nikki\Recent\kernel32.dll
c:\documents and settings\Nikki\Recent\kernel32.drv
c:\documents and settings\Nikki\Recent\kernel32.exe
c:\documents and settings\Nikki\Recent\kernel32.sys
c:\documents and settings\Nikki\Recent\kernel32.tmp
c:\documents and settings\Nikki\Recent\pal.drv
c:\documents and settings\Nikki\Recent\pal.exe
c:\documents and settings\Nikki\Recent\pal.sys
c:\documents and settings\Nikki\Recent\pal.tmp
c:\documents and settings\Nikki\Recent\PE.dll
c:\documents and settings\Nikki\Recent\PE.drv
c:\documents and settings\Nikki\Recent\PE.exe
c:\documents and settings\Nikki\Recent\PE.sys
c:\documents and settings\Nikki\Recent\PE.tmp
c:\documents and settings\Nikki\Recent\ppal.dll
c:\documents and settings\Nikki\Recent\ppal.drv
c:\documents and settings\Nikki\Recent\ppal.exe
c:\documents and settings\Nikki\Recent\ppal.sys
c:\documents and settings\Nikki\Recent\ppal.tmp
c:\documents and settings\Nikki\Recent\runddl.dll
c:\documents and settings\Nikki\Recent\runddl.tmp
c:\documents and settings\Nikki\Recent\runddlkey.drv
c:\documents and settings\Nikki\Recent\runddlkey.exe
c:\documents and settings\Nikki\Recent\runddlkey.sys
c:\documents and settings\Nikki\Recent\runddlkey.tmp
c:\documents and settings\Nikki\Recent\SICKBOY.drv
c:\documents and settings\Nikki\Recent\SICKBOY.exe
c:\documents and settings\Nikki\Recent\SICKBOY.sys
c:\documents and settings\Nikki\Recent\SICKBOY.tmp
c:\documents and settings\Nikki\Recent\sld.dll
c:\documents and settings\Nikki\Recent\sld.drv
c:\documents and settings\Nikki\Recent\sld.exe
c:\documents and settings\Nikki\Recent\sld.sys
c:\documents and settings\Nikki\Recent\sld.tmp
c:\documents and settings\Nikki\Recent\SM.dll
c:\documents and settings\Nikki\Recent\SM.drv
c:\documents and settings\Nikki\Recent\SM.exe
c:\documents and settings\Nikki\Recent\SM.sys
c:\documents and settings\Nikki\Recent\SM.tmp
c:\documents and settings\Nikki\Recent\snl2w.dll
c:\documents and settings\Nikki\Recent\snl2w.drv
c:\documents and settings\Nikki\Recent\snl2w.sys
c:\documents and settings\Nikki\Recent\snl2w.tmp
c:\documents and settings\Nikki\Recent\std.dll
c:\documents and settings\Nikki\Recent\std.drv
c:\documents and settings\Nikki\Recent\std.exe
c:\documents and settings\Nikki\Recent\std.sys
c:\documents and settings\Nikki\Recent\std.tmp
c:\documents and settings\Nikki\Recent\tempdoc.exe
c:\documents and settings\Nikki\Recent\tempdoc.sys
c:\documents and settings\Nikki\Recent\tjd.dll
c:\documents and settings\Nikki\Recent\tjd.drv
c:\documents and settings\Nikki\Recent\tjd.exe
c:\documents and settings\Nikki\Recent\tjd.sys
c:\documents and settings\Nikki\Recent\tjd.tmp
c:\program files\Common Files\Uninstall
c:\program files\WindowsUpdate
c:\windows\system32\drivers\1028_DELL_XPS_Dell DE051 .MRK
c:\windows\system32\drivers\DELL_XPS_Dell DE051 .MRK

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE


((((((((((((((((((((((((( Files Created from 2010-04-03 to 2010-05-03 )))))))))))))))))))))))))))))))
.

2010-05-02 21:41 . 2010-05-02 21:41 -------- d-----w- c:\program files\Computer fixing

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-02 21:14 . 2008-08-31 16:10 -------- d-----w- c:\program files\Google
2010-05-02 00:17 . 2008-07-17 23:38 -------- d-----w- c:\documents and settings\Nikki\Application Data\LimeWire
2010-04-11 02:16 . 2008-08-31 16:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-11 02:14 . 2010-03-07 20:55 -------- d-----w- c:\program files\Little Registry Cleaner
2010-03-24 01:13 . 2009-12-11 19:13 -------- d-----w- c:\program files\Common Files\Apple
2010-03-18 19:57 . 2010-03-18 19:57 -------- d-sh--w- c:\documents and settings\All Users\Application Data\MSFBHW
2010-03-10 19:58 . 2009-12-11 19:24 16992 ----a-w- c:\documents and settings\Nikki\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-10 06:15 . 2004-08-04 10:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-10 01:01 . 2010-03-07 21:30 -------- d-----w- c:\program files\Ask.com
2010-03-09 23:30 . 2008-06-28 02:42 87263 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-03-08 00:10 . 2010-01-20 18:09 3803208 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-07 21:20 . 2010-03-07 21:20 -------- d-----w- c:\program files\MSECache
2010-03-07 21:04 . 2010-03-07 21:03 -------- d-----w- c:\program files\Common Files\Little Registry Cleaner
2010-03-07 20:52 . 2010-03-07 20:52 -------- d-----w- c:\program files\MSBuild
2010-03-07 20:52 . 2010-03-07 20:52 -------- d-----w- c:\program files\Reference Assemblies
2010-03-07 20:44 . 2010-03-07 20:44 -------- d-----w- c:\program files\MSXML 6.0
2010-02-25 06:24 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-04 10:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 13:10 . 2005-03-30 01:23 2189952 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2005-03-30 01:01 2066816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33 . 2004-08-04 10:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-04 10:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-05 00:11 . 2009-12-29 00:07 389784 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-02-05 00:10 . 2009-12-29 00:07 823928 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-05 00:10 . 2009-12-29 00:07 1181328 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 21:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Nikki^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Nikki\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2006-10-17 01:40 1197648 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2005-04-05 18:19 77824 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-04-05 18:22 94208 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-10-11 16:45 75304 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2005-04-05 18:23 114688 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 04:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2004-10-14 18:42 1404928 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-09-28 17:16 185896 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Nikki\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [12/28/2009 8:07 PM 64288]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/2/2009 9:19 AM 1181328]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/13/2010 5:41 PM 135664]
.
Contents of the 'Scheduled Tasks' folder

2010-05-03 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 00:10]

2010-05-03 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 00:10]

2010-05-03 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 00:10]

2010-05-03 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 00:10]

2010-05-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 00:10]

2010-01-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-13 21:41]

2010-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-13 21:41]

2010-05-03 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 21:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://m.www.yahoo.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-My Security Wall - c:\documents and settings\All Users\Application Data\1fdbdf0\MS1fdb.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-03 17:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3028)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2010-05-03 17:35:57 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-03 21:35

Pre-Run: 38,428,168,192 bytes free
Post-Run: 39,782,326,272 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - D18A84B51DF28ADB4F88CE4574E45209

Thanks Gecko I will try this later in the week, gave my sis her desktop back for now. Now on to my own desktop problems, I need to search the hardware forums first. Thanks again!