Hey, guys. Looking for some serious help, here. I'm visiting my parents, and my step-father has completely f'd up his office computer. He's a dangerous man who will click on anything and install anything. He should be banned from anything that connects to the internet. 'Nuff said.

He asked for help getting rid of pop-ups, so I figured it would be an easy fix. Boy, was I in over my head. Here's what I found:

(He's got a custom-built tower with Windows XP Pro and an Intel Processor)

*Internet Explorer 8 closed repeatedly when I tried to search for anything anti-virus-related
*Browser redirects were rampant--clicking on legitimate links took me to ads every time
*Anything anti-virus-related would not run:
--Already-installed McAfee initializes for a split second, then closes
--Browser closed anytime I clicked on a download link for Avast/AVG/etc.
--Tried to run Avast setup from an .exe file I transfered from a CD-ROM to the desktop, and (just like McAfee), it shutdown after a split second
*HijackThis would not install--shuts down after a split second
*I was able to download and run Malwarebytes' Anti-Malware, and it found 9 Trojans, 2 Worms, and 2 backdoors
*After cleaning the errors, I am still having the same issues with browser closing, redirects, anti-virus programs, etc.
*I installed and ran Uniblue's PowerSuite--it found 830+ registry errors, and 16,000+ items in the IE cache. Fixing these errors had no impact on the issues I'm having.
*Logging on as an Administrator in Safe Mode also does nothing to alleviate the problems
*I tried to do a system restore to an earlier point three times...each time (upon reboot,) my computer tells me that Windows is unable to restore my system to the point I have selected. I tried three points that spanned over four months--never seen this happen before.

What in the hell do I do with this thing?? I brought the tower home with me from his office with the hopes that some of you could provide some serious help. Thanks in advance.

First of all, leave Windows registry alone. Playing with it will makes things worse, if it didn't happen already.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.pif
* Rkill.exe

• * Double-click on the Rkill desktop icon to run the tool.
  * If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  * A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  * If not, delete the file, then download and use the one provided in Link 2.
  * If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  * Do not reboot until instructed.
  * If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run then try to immediately run the following.

Now download and run exeHelper.

• * Please download exeHelper from Raktor to your desktop.
  * Double-click on exeHelper.com to run the fix.
  * A black window should pop up, press any key to close once the fix is completed.
  * A log file named log.txt will be created in the directory where you ran exeHelper.com
  * Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

================================================== ===========

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Thanks for responding, Broni. I made it most of the way through your instructions and ran into errors with the Combofix section. Combofix installation went exactly like this website's tutorial said it would. However, when I started the actual scan, the only thing in the blue AutoScan window was the message, "Scanning for infected files...This typically doesn't take more than 10 minutes. However, scan times for badly infected machines may easily double." It never talked about changing my clock settings, and I saw no evidence of it working through the 50+ stages (no "Completed Stage_x" messages.)

The AutoScan window stayed the same for more than 30 minutes. Is this normal? I have attached the only logfile I was able to obtain.

EDIT: Disregard above. I re-ran the programs you recommended, and on the second try, I was able to get Combofix to function correctly. Here are the attachments you requested. Not sure if this is related to the scans I just ran, but my computer seems to be running at a snail's pace, now, compared to when I first posted.

Please, always paste all logs into your reply...

exeHelper by Raktor
Build 20100414
Run at 00:00:24 on 06/04/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

exeHelper by Raktor
Build 20100414
Run at 00:57:54 on 06/04/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

================================================== ======

ComboFix 10-06-03.01 - Dave 06/04/2010 1:00.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.606 [GMT -5:00]
Running from: c:\documents and settings\Dave\Desktop\DOWNLOADS\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ebcadfbb.dll

.
((((((((((((((((((((((((( Files Created from 2010-05-04 to 2010-06-04 )))))))))))))))))))))))))))))))
.

2010-06-04 04:54 . 2001-08-17 18:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2010-06-04 04:54 . 2001-08-17 18:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2010-06-03 23:38 . 2010-06-03 23:38 -------- d-----w- c:\program files\Trend Micro
2010-06-03 23:25 . 2010-06-03 23:25 -------- d-----w- c:\documents and settings\All Users\Uniblue
2010-06-03 23:13 . 2010-06-03 23:25 -------- d-----w- c:\documents and settings\Dave\Application Data\Uniblue
2010-06-03 23:13 . 2010-06-03 23:13 -------- d-----w- c:\program files\Uniblue
2010-06-03 23:09 . 2010-06-03 23:09 -------- d-----w- c:\documents and settings\Dave\Application Data\Windows Desktop Search
2010-06-03 23:09 . 2010-06-03 23:09 -------- d-----w- c:\documents and settings\Dave\Local Settings\Application Data\Mozilla
2010-06-03 21:46 . 2010-06-03 21:46 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-06-03 21:45 . 2010-06-03 22:14 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-06-03 21:42 . 2010-06-03 23:09 -------- d-----w- c:\program files\Windows Desktop Search
2010-06-03 21:42 . 2010-06-03 21:42 -------- d-----w- c:\windows\system32\GroupPolicy
2010-06-03 21:41 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-06-03 21:41 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-06-03 21:41 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-06-03 20:23 . 2010-06-03 20:23 -------- d-----w- c:\documents and settings\Dave\Application Data\Malwarebytes
2010-06-03 20:23 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-03 20:23 . 2010-06-03 23:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-03 20:23 . 2010-06-03 20:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-03 20:23 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-03 20:00 . 2010-06-03 20:00 0 ----a-w- c:\windows\nsreg.dat
2010-05-21 17:28 . 2010-05-21 17:28 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2010-06-03 23:23 . 2009-07-15 16:44 -------- d-----w- c:\documents and settings\Dave\Application Data\Apple Computer
2010-06-03 23:09 . 2009-10-01 19:01 -------- d-----w- c:\program files\Common Files\logishrd
2010-06-03 23:09 . 2009-10-01 19:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd
2010-06-03 21:54 . 2009-10-01 19:49 -------- d-----w- c:\program files\Logitech
2010-06-03 21:26 . 2008-12-03 20:55 -------- d-----w- c:\program files\Google
2010-06-03 19:38 . 2008-09-15 17:11 -------- d-----w- c:\program files\Bonjour
2010-05-21 17:36 . 2008-09-15 17:11 -------- d-----w- c:\program files\iTunes
2010-05-21 17:28 . 2008-09-15 17:11 -------- d-----w- c:\program files\iPod
2010-05-21 17:26 . 2008-09-05 20:56 -------- d-----w- c:\program files\Apple Software Update
2010-05-11 18:24 . 2008-08-30 16:43 -------- d-----w- c:\program files\Microsoft Works
2010-05-10 21:18 . 2008-09-05 20:57 -------- d-----w- c:\program files\QuickTime
2010-05-10 21:17 . 2008-09-15 17:09 -------- d-----w- c:\program files\Common Files\Apple
2010-05-04 16:16 . 2008-08-30 16:29 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-05-04 16:16 . 2010-06-03 23:35 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2010-05-04 16:16 . 2009-10-02 14:56 38784 ----a-w- c:\documents and settings\Dave\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2010-04-28 20:45 . 2010-04-28 20:45 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe
2010-04-19 23:33 . 2009-08-15 18:10 -------- d-----w- c:\documents and settings\Dave\Application Data\HpUpdate
2010-04-01 08:23 . 2010-04-01 08:23 75776 ------w- c:\windows\system32\fffa.sys
2010-03-17 13:51 . 2010-03-29 15:13 82696 ----a-w- c:\windows\system32\lmdimon8.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-28 152872]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 454784]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2008-12-20 39408]
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2007-12-19 131072]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16859648]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]

c:\documents and settings\Dave\Start Menu\Programs\Startup\
Logitech . Product Registration.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ActiveKEY PC Sync.lnk - c:\program files\GE Security\AKeyPCSyncApp.exe [2008-9-5 278528]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2009-11-6 819200]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Documents and Settings\\Dave\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Dave\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\ATT-HSI\\McciBrowser.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=

R1 fffa;fffa;c:\windows\system32\fffa.sys [4/1/2010 3:23 AM 75776]
R2 AKeyPCSyncService;ActiveKEY PCSync;c:\program files\GE Security\AKeyPCSyncService.exe [9/5/2008 4:14 PM 98304]
S0 8f2069c5c28a5d9e301e67d9d8e74b9f;8f2069c5c28a5d9e3 01e67d9d8e74b9f;c:\windows\system32\8f2069c5c28a5d 9e301e67d9d8e74b9f.sys --> c:\windows\system32\8f2069c5c28a5d9e301e67d9d8e74b 9f.sys [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 22:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]

2010-06-04 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Windows &Live Favorites - Welcome to Windows Live
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {61BB6943-A0FF-4637-AA85-47290BDE178E} - hxxps://www.formulatoronline.com/downloads/TFLauncher.dll
.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-06-04 01:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(5172)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\brss01a.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\Brmfrmps.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
************************************************** ************************
.
Completion time: 2010-06-04 01:12:13 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-04 06:11

Pre-Run: 224,669,810,688 bytes free
Post-Run: 224,880,521,216 bytes free

- - End Of File - - 0EA9B8E7C7DB9EB72FD5A33738E47FBB

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

================================================== ===========

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File::
c:\windows\system32\fffa.sys
c:\windows\system32\8f2069c5c28a5d9e301e67d9d8e74b9f.sys


Driver::
fffa
8f2069c5c28a5d9e301e67d9d8e74b9f

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt

Here is the SECURITYCHECK LOG:

Results of screen317's Security Check version 0.99.4
Windows XP Service Pack 3
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
OneCare Advisor (Windows Live Toolbar)
McAfee Security Scan
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Adobe Flash Player
Adobe Reader 9.3.2
````````````````````````````````
Process Check:
objlist.exe by Laurent
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

I had some issues running Combofix this time. During the first attempt, I received multiple error warnings from Windows during the part where Combofix attempts to create a restore point. Also, upon reboot, I received multiple errors, and the logfile was not created. Here is an example of the errors:

Error saving file
C:\WINDOWS\erdnt\subs\Users\00000003\NTUSER.DAT !

Continue with the next file?

[ RegSaveKeyEx: 1016 - An I/O operation initiated by the registry failed unrecoverably. The registry could not read in, or write out, or flush, one of the files that contain the system's image of the registry ]

I also discovered that the computer was downloading Windows updates and auto-installing them. Do I need to disable this temporarily? Additionally, there are several programs that load everytime the system reboots (printer software, webcam, etc.) Should I remove these from the boot menu?

I re-ran the CFScript + Combofix a second time, and this time went more smoothly, although not perfectly. No problem during the restore point creation, but after the reboot, while it was trying to create the log, I received a message which indicated that not enough system resources were available for the operation. There were also several repeated messages which said that the specified file could not be found. At the end, the logfile popped up in its own window. The computer is still running very slowly.

Here is the new COMBOFIX LOGFILE:

ComboFix 10-06-03.01 - Dave 06/04/2010 10:32:48.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.630 [GMT -5:00]
Running from: c:\documents and settings\Dave\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dave\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\8f2069c5c28a5d9e301e67d9d8e74 b9f.sys"
"c:\windows\system32\fffa.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\fffa.sys
.
---- Previous Run -------
.
c:\windows\TEMP\logishrd\LVPrcInj01.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_8F2069C5C28A5D9E301E67D9D8E74B9F
-------\Legacy_FFFA
-------\Service_8f2069c5c28a5d9e301e67d9d8e74b9f
-------\Service_fffa
-------\Legacy_8F2069C5C28A5D9E301E67D9D8E74B9F
-------\Legacy_FFFA
-------\Service_8f2069c5c28a5d9e301e67d9d8e74b9f
-------\Service_fffa


((((((((((((((((((((((((( Files Created from 2010-05-04 to 2010-06-04 )))))))))))))))))))))))))))))))
.

2010-06-04 10:42 . 2009-08-13 15:16 512000 -c----w- c:\windows\system32\dllcache\jscript.dll
2010-06-04 04:54 . 2001-08-17 18:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2010-06-04 04:54 . 2001-08-17 18:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2010-06-03 23:38 . 2010-06-03 23:38 -------- d-----w- c:\program files\Trend Micro
2010-06-03 23:25 . 2010-06-03 23:25 -------- d-----w- c:\documents and settings\All Users\Uniblue
2010-06-03 23:13 . 2010-06-03 23:25 -------- d-----w- c:\documents and settings\Dave\Application Data\Uniblue
2010-06-03 23:13 . 2010-06-03 23:13 -------- d-----w- c:\program files\Uniblue
2010-06-03 23:09 . 2010-06-03 23:09 -------- d-----w- c:\documents and settings\Dave\Application Data\Windows Desktop Search
2010-06-03 23:09 . 2010-06-03 23:09 -------- d-----w- c:\documents and settings\Dave\Local Settings\Application Data\Mozilla
2010-06-03 21:46 . 2010-06-03 21:46 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-06-03 21:45 . 2010-06-03 22:14 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-06-03 21:42 . 2010-06-04 15:29 -------- d-----w- c:\program files\Windows Desktop Search
2010-06-03 21:42 . 2010-06-03 21:42 -------- d-----w- c:\windows\system32\GroupPolicy
2010-06-03 21:41 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-06-03 21:41 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-06-03 21:41 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-06-03 20:23 . 2010-06-03 20:23 -------- d-----w- c:\documents and settings\Dave\Application Data\Malwarebytes
2010-06-03 20:23 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-03 20:23 . 2010-06-03 23:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-03 20:23 . 2010-06-03 20:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-03 20:23 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-03 20:00 . 2010-06-03 20:00 0 ----a-w- c:\windows\nsreg.dat
2010-05-21 17:28 . 2010-05-21 17:28 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2010-06-03 23:23 . 2009-07-15 16:44 -------- d-----w- c:\documents and settings\Dave\Application Data\Apple Computer
2010-06-03 23:09 . 2009-10-01 19:01 -------- d-----w- c:\program files\Common Files\logishrd
2010-06-03 23:09 . 2009-10-01 19:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd
2010-06-03 21:54 . 2009-10-01 19:49 -------- d-----w- c:\program files\Logitech
2010-06-03 21:26 . 2008-12-03 20:55 -------- d-----w- c:\program files\Google
2010-06-03 19:38 . 2008-09-15 17:11 -------- d-----w- c:\program files\Bonjour
2010-05-21 17:36 . 2008-09-15 17:11 -------- d-----w- c:\program files\iTunes
2010-05-21 17:28 . 2008-09-15 17:11 -------- d-----w- c:\program files\iPod
2010-05-21 17:26 . 2008-09-05 20:56 -------- d-----w- c:\program files\Apple Software Update
2010-05-11 18:24 . 2008-08-30 16:43 -------- d-----w- c:\program files\Microsoft Works
2010-05-10 21:18 . 2008-09-05 20:57 -------- d-----w- c:\program files\QuickTime
2010-05-10 21:17 . 2008-09-15 17:09 -------- d-----w- c:\program files\Common Files\Apple
2010-05-04 16:16 . 2008-08-30 16:29 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-05-04 16:16 . 2010-06-03 23:35 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2010-05-04 16:16 . 2009-10-02 14:56 38784 ----a-w- c:\documents and settings\Dave\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2010-04-28 20:45 . 2010-04-28 20:45 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe
2010-04-19 23:33 . 2009-08-15 18:10 -------- d-----w- c:\documents and settings\Dave\Application Data\HpUpdate
2010-03-17 13:51 . 2010-03-29 15:13 82696 ----a-w- c:\windows\system32\lmdimon8.dll
2010-03-09 11:09 . 2007-07-27 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-28 152872]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 454784]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2008-12-20 39408]
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2007-12-19 131072]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16859648]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]

c:\documents and settings\Dave\Start Menu\Programs\Startup\
Logitech . Product Registration.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ActiveKEY PC Sync.lnk - c:\program files\GE Security\AKeyPCSyncApp.exe [2008-9-5 278528]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2009-11-6 819200]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Documents and Settings\\Dave\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Dave\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\ATT-HSI\\McciBrowser.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=

R2 AKeyPCSyncService;ActiveKEY PCSync;c:\program files\GE Security\AKeyPCSyncService.exe [9/5/2008 4:14 PM 98304]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 22:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]

2010-06-04 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Windows &Live Favorites - Welcome to Windows Live
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {61BB6943-A0FF-4637-AA85-47290BDE178E} - hxxps://www.formulatoronline.com/downloads/TFLauncher.dll
.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-06-04 10:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\brss01a.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\Brmfrmps.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\SearchIndexer.exe
.
************************************************** ************************
.
Completion time: 2010-06-04 10:43:53 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-04 15:43
ComboFix2.txt 2010-06-04 06:12

Pre-Run: 224,871,583,744 bytes free
Post-Run: 224,997,666,816 bytes free

- - End Of File - - DCED856550C4C96CB4793F0A1CCDAD55

I also discovered that the computer was downloading Windows updates and auto-installing them. Do I need to disable this temporarily?

Yes, please.

Additionally, there are several programs that load everytime the system reboots (printer software, webcam, etc.) Should I remove these from the boot menu?

We'll get there toward the end of this topic.

Download GMER: GMER - Rootkit Detector and Remover, by clicking on Download EXE button.
Alternative downloads:
- |MG| GMER 1.0.15.15281 Download
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
Do NOT use the computer while GMER is running!
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

================================================== ==========

Download Malwarebytes' Anti-Malware (|MG| Malwarebytes Anti-Malware 1.46 Download) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

I had some trouble running GMER the first time. After the program opened, it found something it didn't like, and I saw a file listed in red font. A popup window mentioned something about changes to the registry or rootkit, and it asked me if I wanted to scan the computer. I clicked OK/Yes/etc., and it began to scan. I did not have to find the "Rootkit" tab or click on the "Scan" button. About 20 minutes into the scan, the computer unexpectedly rebooted itself. I do not know why, and I wasn't paying enough attention to the scan to see which file it was on. There was no logfile created after the reboot.

After the reboot was complete, I ran GMER again. This time, there were no apparent issues. No popup windows, and I had to find the "Rootkit" tab, as you instructed. I started the scan by clicking the "Scan" button. I have attached the resulting logfile.

I am now completing the second part of your instructions and will post the Malwarebytes Anti-Malware log shortly.

GMER LOGFILE:

GMER 1.0.15.15281 - GMER - Rootkit Detector and Remover
Rootkit scan 2010-06-04 13:55:47
Windows 5.1.2600 Service Pack 3
Running: k1w236tw.exe; Driver: C:\DOCUME~1\Dave\LOCALS~1\Temp\agpyrpoc.sys


---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\SearchIndexer.exe[2864] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe[344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [026C2F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe[344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [026C2C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe[344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [026C2CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe[344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [026C2CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[384] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [02C82F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[384] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [02C82C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[384] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [02C82CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[384] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [02C82CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\Logitech Vid\vid.exe[484] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [0CBB2F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\Logitech Vid\vid.exe[484] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [0CBB2C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\Logitech Vid\vid.exe[484] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [0CBB2CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\Logitech Vid\vid.exe[484] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [0CBB2CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1768] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [02852F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1768] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [02852C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1768] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [02852CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1768] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [02852CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs InCDrec.SYS (InCD File System Recognizer/Nero AG)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000

---- EOF - GMER 1.0.15 ----

Here is the logfile from my latest Malwarebytes Anti-Malware scan:

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 4169

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

6/4/2010 2:31:00 PM
mbam-log-2010-06-04 (14-31-00).txt

Scan type: Quick scan
Objects scanned: 130085
Time elapsed: 13 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





The computer seems to be healing. I tried using the search function in IE to go to anti-virus websites, and it no longer automatically closes down. Also, the browser redirects seem to be gone, as well. Whatever it is you're doing, Broni, it seems to be working.

For reference, here is the orginial Malwarebytes logfile (from yesterday) that alerted me to all of the issues that were present on this machine:

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 4168

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

6/3/2010 4:22:57 PM
mbam-log-2010-06-03 (16-22-57).txt

Scan type: Full scan (C:\|)
Objects scanned: 251777
Time elapsed: 57 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 20
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 20

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\aecdfcafbbeecb.dll (Worm.AutoRun) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\aecdfcafbbeecb (Worm.AutoRun) -> Delete on reboot.
HKEY_CLASSES_ROOT\apar (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ae17dd77-e0f3-44dd-8cba-1ebce6b5ed55} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4cbcc4e2-073c-4109-a719-458d8cf9900e} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{506cd401-5203-4b27-bb5a-03c97758fd02} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{506cd401-5203-4b27-bb5a-03c97758fd02} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{506cd401-5203-4b27-bb5a-03c97758fd02} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\parttimeb (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1428a472-5260-404e-9977-7ecdf1daf936} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{1428a472-5260-404e-9977-7ecdf1daf936} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{1d216076-93c9-477f-9bc7-9c39ad31640b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{2502bbd0-d73b-11dd-b4ec-cebf56d89593} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{6b3e26a3-c1e2-4125-8c8f-f1303f748c3a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{f70f6880-3a4b-11de-8230-0b7c55d89593} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{35a5b43b-cb8a-49ca-a9f4-d3b308d2e3cc} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\system guard 2009 (Rogue.SystemGuard) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\System Guard 2009 (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servis es (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce\spywareguarduninstall (Rogue.SystemGuard) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\DLLs (Rogue.SystemGuard) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\TSUninstall (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:\Program Files\System Guard 2009 (Rogue.SystemGuard) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\aecdfcafbbeecb.dll (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\system32\lastmon.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\System Guard 2009\systemguard.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{512018D4-0A40-4838-8635-9A9EC1FD0C32}\RP682\A0030334.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\8f2069c5c28a5d9e301e67d9d8e74b 9f.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\winlogon.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\svchost.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dave\Local Settings\Temporary Internet Files\Content.IE5\EQZ8RM95\u362[1].ini (Adware.BHO) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\TSUninstall\Uninstall.lnk (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:\Program Files\System Guard 2009\uninstall.exe (Rogue.SystemGuard) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\track.sys (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dave\Desktop\Control Center.lnk (Rogue.ControlCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\TS\Computer Scan.lnk (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\TS\Help.lnk (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\TS\Settings.lnk (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\TS\Total Security.lnk (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\TS\Update.lnk (Rogue.TotalSecurity) -> Quarantined and deleted successfully.
C:\WINDOWS\spoolSystem.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\WINDOWS\syscert.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\WINDOWS\vmreg.dll (Rogue.SpywareGuard) -> Quarantined and deleted successfully.