So, what's the way to contact a member privately?
Due to bad guys watching, I can't post my private Combofix download link in the open.

If this is the only approach to the problem then for the time being I'd suggest sending an e-mail.

You will see the OPs address on his/her membership page which Mods have access to.

Thanks. I found it.
I'm not getting email notifications here...dang.

Joe. I just sent you an email.

ComboFix 09-05-30.01 - Joe 30/05/2009 17:56.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1023.649 [GMT 1:00]
Running from: c:\tools-av\7561\7561.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Joe\Application Data\wiaserva.log
c:\progra~1\COMMON~1\{304F0~1
c:\progra~1\COMMON~1\{B04F0~1
c:\windows\cleanmgr.exe
c:\windows\ieocx.dll
c:\windows\system\dllhost.exe
c:\windows\system\internat.exe
c:\windows\system\msvbvm60.dll
c:\windows\system\oeminfo.ini
c:\windows\system\rsvp.exe
c:\windows\system32\drivers\UACkmttdilmyruunwt.sys
c:\windows\system32\inform.dat
c:\windows\system32\kjs
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\UACdexmtuysmxuoevp.log
c:\windows\system32\UACevtvmglinaogpyf.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UAClpopxskjgoaqrsn.dat
c:\windows\system32\UACntcfjamgyqkikrg.dll
c:\windows\system32\UACpnnxudyldvljwtx.log
c:\windows\system32\UACsqbohkamacrdoes.log
c:\windows\system32\UACsrkusspvydpptiw.dll
c:\windows\system32\UACufmnaeydjeaimpx.dll
c:\windows\system32\UACxjdmeoclkkkcytq.dll
c:\windows\WINVER.EXE
c:\windows\wuauclt.exe

c:\windows\system32\grpconv.exe was missing
Restored copy from - c:\windows\$NtServicePackUninstall$\grpconv.exe

c:\windows\system32\proquota.exe was missing
Restored copy from - c:\windows\$NtServicePackUninstall$\proquota.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-30 )))))))))))))))))))))))))))))))
.

2009-05-30 17:03 . 2004-08-04 12:00 50176 -c--a-w c:\windows\system32\dllcache\proquota.exe
2009-05-30 17:03 . 2004-08-04 12:00 50176 ----a-w c:\windows\system32\proquota.exe
2009-05-30 17:03 . 2004-08-04 12:00 39424 -c--a-w c:\windows\system32\dllcache\grpconv.exe
2009-05-30 17:03 . 2004-08-04 12:00 39424 ----a-w c:\windows\system32\grpconv.exe
2009-05-30 16:31 . 2009-05-30 16:32 -------- d-----w C:\Tools-AV
2009-05-30 16:13 . 2009-05-30 16:13 -------- d-s---w C:\3247
2009-05-30 16:09 . 2009-05-30 16:10 -------- d-----w C:\Load-CF
2009-05-27 16:32 . 2009-05-27 16:32 -------- d-----w c:\program files\Trend Micro
2009-05-27 01:10 . 2009-05-27 01:10 -------- d-----w c:\documents and settings\Administrator\Application Data\Sony Ericsson
2009-05-27 01:09 . 2009-05-27 01:09 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-05-26 23:55 . 2009-05-26 23:55 174 ----a-w c:\documents and settings\Joe\Application Data\asd.bat
2009-05-25 23:42 . 2009-05-27 22:19 152576 ----a-w c:\documents and settings\Joe\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-20 18:15 . 2009-05-28 18:16 390664 ----a-w c:\documents and settings\Joe\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-19 14:09 . 2009-05-05 21:00 2051864 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-19 14:09 . 2009-05-05 21:00 177432 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll
2009-05-19 14:09 . 2009-05-05 21:00 424472 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll
2009-05-19 14:09 . 2009-05-05 21:00 312088 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll
2009-05-19 14:09 . 2009-05-05 21:00 3288344 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-05-19 14:09 . 2009-05-05 21:01 486168 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe
2009-05-19 14:05 . 2009-05-05 21:00 1437464 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-05-19 14:05 . 2009-05-05 20:59 755992 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll
2009-05-17 18:28 . 2009-05-17 18:28 390664 ----a-w c:\documents and settings\Steve\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-16 14:30 . 2009-05-05 21:00 2302232 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll
2009-05-16 14:30 . 2009-05-05 21:00 3399960 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-05-09 16:55 . 2009-05-09 16:56 -------- d-----w c:\program files\TVAnts
2009-05-06 19:05 . 2009-05-06 19:06 -------- d-----w c:\program files\Veetle
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w c:\windows\system32\GPhotos.scr

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-05-30 17:07 . 2008-04-04 18:18 -------- d-----w c:\documents and settings\All Users\Application Data\Kontiki
2009-05-30 16:55 . 2007-07-26 13:03 809 --sha-w c:\windows\system32\mmf.sys
2009-05-30 16:28 . 2006-11-15 22:03 -------- d-----w c:\documents and settings\Joe\Application Data\OpenOffice.org2
2009-05-30 16:25 . 2008-01-03 21:48 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-30 16:24 . 2007-02-04 21:13 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-30 16:24 . 2007-02-04 21:13 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-27 22:41 . 2006-07-09 12:09 -------- d-----w c:\program files\Java
2009-05-25 17:39 . 2008-05-20 19:59 -------- d-----w c:\documents and settings\Steve\Application Data\AVGTOOLBAR
2009-05-20 15:26 . 2009-02-28 23:40 -------- d-----w c:\documents and settings\Joe\Application Data\Spotify
2009-05-18 18:22 . 2008-01-03 21:48 -------- d-----w c:\program files\MSN Games
2009-05-06 19:09 . 2009-04-18 17:31 -------- d-----w c:\documents and settings\Joe\Application Data\Azureus
2009-05-06 13:48 . 2008-05-20 18:24 -------- d-----w c:\documents and settings\Daphne\Application Data\AVGTOOLBAR
2009-05-05 21:01 . 2008-05-20 17:14 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-05 21:01 . 2008-05-20 17:14 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-05 21:01 . 2007-05-26 13:27 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys
2009-05-05 21:00 . 2008-05-20 17:14 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-05 20:59 . 2008-05-20 17:14 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-27 21:21 . 2009-04-07 21:24 -------- d-----w c:\documents and settings\Joe\Application Data\uTorrent
2009-04-24 18:35 . 2006-07-05 19:18 -------- d-----w c:\program files\MSN Messenger
2009-04-24 18:35 . 2006-10-10 19:31 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-23 20:58 . 2009-04-23 20:58 -------- d-----w c:\program files\TomTom International B.V
2009-04-23 20:55 . 2007-10-18 19:55 -------- d-----w c:\program files\TomTom HOME 2
2009-04-18 17:31 . 2009-04-18 17:31 -------- d-----w c:\documents and settings\All Users\Application Data\Azureus
2009-04-05 15:51 . 2009-04-05 15:51 1878984 ----a-w c:\documents and settings\Joe\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-03-15 16:17 . 2006-07-03 13:06 65144 -c--a-w c:\documents and settings\Daphne\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-15 13:41 . 2006-06-03 15:17 65144 -c--a-w c:\documents and settings\Joe\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-12 21:43 . 2009-03-12 21:43 75048 -c--a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.0.51\SetupAdmin.exe
2009-03-09 04:19 . 2008-12-19 14:21 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2004-08-04 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-05 23:59 . 2008-09-11 15:55 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-05 23:59 . 2008-09-11 15:55 1900544 -c--a-w c:\windows\system32\usbaaplrc.dll
2009-03-03 00:18 . 2004-08-04 12:00 826368 ----a-w c:\windows\system32\wininet.dll
2000-06-08 16:00 . 2006-04-25 19:08 110080 -csha-r c:\windows\COMMAND\EBD\winboot.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY. DLL" [2003-07-28 49152]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 487424]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-18 185896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-05 1947928]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-11 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-12-22 77824]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-07-28 323584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Joe\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - c:\program files\OpenOffice.org 2.0\program\quickstart.exe [2006-7-14 393216]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-9-5 65588]
Microsoft Works Calendar Reminders.lnk - c:\windows\Installer\{F128BA10-362E-11D3-81AB-00C04FB932BA}\4EBD23F5.exe [2006-4-25 29184]
NETGEAR WPN111 Smart Wizard.lnk - c:\program files\NETGEAR\WPN111\wpn111.exe [2007-4-7 884838]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-05 21:00 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Sports Interactive\\Football Manager 2006\\fm.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
"c:\\Program Files\\Last.fm\\LastFM.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\Sports Interactive\\Football Manager 2007\\fm.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Joe\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Documents and Settings\\Joe\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Sports Interactive\\Football Manager 2009\\fm.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=

R0 pmfilt;pmfilt;c:\windows\system32\drivers\pmfilt.s ys [11/07/2006 21:32 10112]
R0 pmhelp;pmhelp;c:\windows\system32\drivers\pmhelp.s ys [11/07/2006 21:32 50464]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [20/05/2008 18:14 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [20/05/2008 18:14 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [20/05/2008 18:14 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [27/01/2009 22:13 298776]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssflt r_tdi.sys [15/03/2009 14:40 55152]
R2 gearsec;gearsec;c:\windows\system32\gearsec.exe [01/12/2003 16:27 53248]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [26/07/2007 14:03 2560]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [08/04/2009 11:38 92008]
R3 slnt;Realtek Rtl-8139d PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [04/08/2007 10:58 18004]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [07/04/2007 21:03 17149]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 19:08 533360]
S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\drivers\WPN111.sys [07/04/2007 21:03 362944]
.
Contents of the 'Scheduled Tasks' folder

2009-05-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-05-30 c:\windows\Tasks\User_Feed_Synchronization-{F702FCDB-B033-44EB-8825-90656C93D852}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:58]
.
- - - - ORPHANS REMOVED - - - -

BHO-{C3221010-0AD7-4c09-B17B-EDCFFDA4B7F9} - fow64.dll
HKCU-Run-Steam - c:\program files\Steam\Steam.exe
HKCU-Run-brastia - c:\windows\system32\brastia.exe
HKLM-Run-SpyHunter - c:\program files\Enigma Software Group\SpyHunter\SpyHunter.exe
HKLM-Run-brastia - c:\windows\system32\brastia.exe
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.micros oft:en-US&ie=utf8&oe=utf8
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: {04CC2CE2-BBC4-43B6-96D6-E1C3E0BA120F} - hxxps://www.hmvdigital.com/HMV.Digital.WebStore.Portal/Pages/System/Secure/HMV.Digital.Downloader.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} - hxxp://67.15.101.3/g_bin/eng/snooker_2_0_0_28.cab
FF - ProfilePath - c:\documents and settings\Joe\Application Data\Mozilla\Firefox\Profiles\yfp7xqtj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector .dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-30 18:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout\Columns\Clubs]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout\Columns\Players]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout\Columns\Staff]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout\Rating Coefficients]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout 2008]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout 2008\Columns\Clubs]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout 2008\Columns\Players]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout 2008\Columns\Staff]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout 2008\Rating Coefficients]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\G*e*n*i*e*"!\FM Genie Scout 2009 XE]
---safe keys omitted to shorten the log----

[HKEY_USERS\S-1-5-21-725345543-484061587-682003330-1006\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\{52419815-FFFC-5588-B1D0-B638D874F711}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abokbhebegchhlhkppdloihamphbidgjcc"=hex:61,61,00, 00
"bbokbhebegchhlhkppcldomghakepkgcagao"=hex:61,61,0 0,00

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtr l\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \C6F447273BC65EF0]
"1"=hex:af,49,68,4a,a1,03,67,91,19,71,84,cd,48,2c, 98,f8,ee,08,c6,eb,cb,98,eb,
30,ad,8c,c5,8a,3e,53,91,13
"2"=hex:58,11,50,42,2e,f2,55,51,6f,f7,9a,ef,6b,f3, 36,21,ec,a7,58,e2,e8,c3,4d,
78,80,c1,ec,38,21,d8,13,6c
"3"=hex:af,49,68,4a,a1,03,67,91,19,71,84,cd,48,2c, 98,f8,e7,e9,9a,5d,76,44,f3,
e8,cb,fa,f8,8a,c7,df,0f,18,db,65,d2,ff,d4,73,8c,c0 ,e1,dd,91,71,a1,e6,83,ee,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtr l\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \C6F447273BC65EF0\3BF25C2B28ED7DA2F167FBF897B494F0]
"1"=hex:8c,de,d0,aa,f8,58,db,1b,5a,48,bb,3c,bc,6d, 16,45,68,f3,d3,2f,c8,68,21,
68
"2"=hex:81,20,8f,ab,28,6a,52,9c
"3"=hex:dd,84,46,47,eb,3b,17,f2,34,f3,25,a0,8d,f1, 19,1e,33,12,34,89,ee,a7,4a,
05,19,c4,d4,52,5f,15,99,e3,39,01,d3,9b,a1,ce,54,a5 ,d6,10,19,42,27,b7,50,61,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52, f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb ,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3, 39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9 ,d4,1a,3d,68,9d,00,32,20
"7"=hex:da,dd,13,74,dd,46,90,2c,b4,13,aa,32,f0,b9, 86,f0,9c,c3,0c,e5,75,1e,7c,
9a,18,4b,60,3b,4d,c8,93,e8,cd,89,11,03,14,be,9d,dd ,f6,b6,6d,d9,44,db,ea,5d,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78, c4,c5,bf,0c,1a,52,a6,e7,1b,
f8,8f,ad,2f,ee,2b,2a,17,6b,97,01,da,d6,d5,69,51,39 ,da,b9,ad,87,18,62,1d,ff,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:f8,fe,42,b7,de,5f,ba,f0
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
Completion time: 2009-05-30 18:10
ComboFix-quarantined-files.txt 2009-05-30 17:09

Pre-Run: 10,190,131,200 bytes free
Post-Run: 11,316,387,840 bytes free

3339 --- E O F --- 2009-05-27 18:37

Right, so where do I go from here?

Combofix did very nice job, so you should be able...

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

RESTART COMPUTER

STEP 4. Download HijackThis:
http://www.trendsecure.com/portal/en...kthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackThis log.
Do NOT attempt to "fix" anything!


DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Right, just printing those off and about to have a go.

Thanks!

Cool