Here is the Combofix Log:
ComboFix 09-11-19.05 - Owner 11/20/2009 21:43.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1468 [GMT -5:00]
Running from: G:\ComboFix.exe
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\kb913800.exe
c:\windows\system32\bszip.dll
E:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-10-21 to 2009-11-21 )))))))))))))))))))))))))))))))
.
2009-11-20 15:25 . 2009-11-20 15:25 -------- d-----w- c:\program files\KeyScrambler
2009-11-20 15:25 . 2009-10-04 21:33 115312 ----a-w- c:\windows\system32\drivers\keyscrambler.sys
2009-11-20 10:31 . 2009-10-16 17:12 1119488 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-11-20 10:30 . 2009-11-20 15:31 -------- d-----w- C:\$AVG
2009-11-20 10:30 . 2009-11-20 10:30 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-20 10:30 . 2009-11-20 10:30 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-20 10:29 . 2009-11-20 10:29 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-11-20 10:29 . 2009-11-20 10:29 -------- d-----w- c:\windows\system32\drivers\Avg
2009-11-20 10:29 . 2009-11-20 11:10 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-11-20 10:29 . 2009-11-20 10:29 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-20 10:29 . 2009-11-20 10:29 -------- d-----w- c:\program files\AVG
2009-11-20 10:29 . 2009-11-20 10:29 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-11-20 02:42 . 2009-11-20 02:42 0 ----a-w- c:\windows\system32\drivers\uiusys.sys
2009-11-20 02:42 . 2008-04-13 19:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2009-11-20 02:42 . 2008-04-13 19:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2009-11-20 02:36 . 2009-11-20 02:36 -------- d-----w- c:\documents and settings\Owner.YOUR-0CDC4F5844\Local Settings\Application Data\Threat Expert
2009-11-20 02:26 . 2009-11-20 23:25 69 ----a-w- c:\windows\RunSC.bat
2009-11-20 02:26 . 2009-11-20 23:25 -------- d-----w- c:\program files\SmartScan
2009-11-20 02:14 . 2009-11-20 02:38 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-20 01:20 . 2009-11-20 01:33 -------- d-----w- c:\program files\RegCure
2009-11-20 01:20 . 2009-11-20 01:20 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
2009-11-20 00:38 . 2009-11-20 00:38 209008 ----a-w- c:\windows\system32\kbhookdll.dll
2009-11-20 00:38 . 2009-11-20 00:38 102912 ----a-w- c:\windows\system32\VB6STKIT.DLL
2009-11-04 11:04 . 2009-11-04 11:04 2272 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-11-03 16:14 . 2009-11-03 16:14 -------- d-----w- c:\documents and settings\Owner.YOUR-0CDC4F5844\Local Settings\Application Data\Autodesk
2009-11-03 16:14 . 2009-11-03 16:14 -------- d-----w- c:\documents and settings\Owner.YOUR-0CDC4F5844\Application Data\Autodesk
2009-11-03 16:14 . 2009-11-03 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2009-11-03 16:11 . 2009-11-03 16:11 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2009-11-03 16:11 . 2009-11-03 16:11 -------- d-----w- c:\program files\Autodesk
2009-10-29 07:09 . 2009-10-29 07:09 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-10-28 12:53 . 2009-08-06 23:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-10-28 12:53 . 2009-08-06 23:23 215920 ----a-w- c:\windows\system32\muweb.dll
2009-10-28 10:44 . 2009-10-28 10:44 -------- d-----w- c:\documents and settings\Owner.YOUR-0CDC4F5844\Local Settings\Application Data\Microsoft Help
2009-10-28 10:43 . 2009-11-12 08:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-28 10:31 . 2009-10-28 10:50 -------- d-----w- c:\documents and settings\Owner.YOUR-0CDC4F5844\Application Data\GetRightToGo
2009-10-23 10:23 . 2009-10-23 10:23 -------- d-----w- c:\documents and settings\kids\Local Settings\Application Data\PCHealth
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-11-20 23:24 . 2008-05-20 10:02 11303 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\qbbackup.sys
2009-11-20 22:21 . 2008-06-04 13:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-20 02:55 . 2006-09-17 15:51 -------- d-----w- c:\program files\Microsoft Works
2009-11-20 02:54 . 2007-02-27 01:50 -------- d-----w- c:\program files\Lexmark 4200 Series
2009-11-20 02:53 . 2006-09-17 15:47 -------- d-----w- c:\program files\GemMaster
2009-11-20 02:44 . 2009-05-07 10:28 -------- d-----w- c:\program files\ZipItFree
2009-11-20 02:44 . 2007-04-27 09:50 -------- d-----w- c:\program files\NetWaiting
2009-11-20 02:43 . 2007-05-25 14:22 -------- d-----w- c:\program files\Google
2009-11-20 02:43 . 2006-09-17 16:12 -------- d-----w- c:\program files\DivX
2009-11-20 02:43 . 2007-07-04 00:30 -------- d-----w- c:\program files\Check Printing Software 2000 V2.0
2009-11-20 01:37 . 2006-09-17 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\WildTangent
2009-11-20 01:35 . 2006-09-17 15:31 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-11-20 01:03 . 2006-09-17 15:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-11-12 11:37 . 2006-09-17 15:23 107000 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-11 21:07 . 2009-09-16 01:23 1010 ----a-w- c:\documents and settings\Owner.YOUR-0CDC4F5844\Application Data\wklnhst.dat
2009-10-09 10:11 . 2008-10-20 13:02 -------- d-----w- c:\documents and settings\Owner.YOUR-0CDC4F5844\Application Data\U3
2009-10-02 12:03 . 2008-05-23 13:07 849184 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\Components\DownloadQB18\Patch\qbpatch.exe
2009-09-25 10:46 . 2008-09-23 11:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-24 10:24 . 2009-09-24 10:24 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.e xe
2009-09-11 14:18 . 2006-03-16 04:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2006-03-16 04:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2006-03-16 04:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2006-03-16 04:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2007-03-11 01:25 . 2007-03-11 01:25 251 ----a-w- c:\program files\wt3d.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-10-16 17:12 1119488 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray. dll" [2006-07-20 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 794713]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"Lexmark 4200 Series"="c:\program files\Lexmark 4200 Series\lxbmbmgr.exe" [2004-01-16 57344]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-10 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-10 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-20 2020120]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-20 1519616]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-06-02 61952]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-9-16 972064]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2009-8-7 1089536]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-20 10:30 12464 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\aawservice]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Pavilion Webcam Tray Icon.lnk]
backup=c:\windows\pss\HP Pavilion Webcam Tray Icon.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Run Google Web Accelerator.lnk]
backup=c:\windows\pss\Run Google Web Accelerator.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner.YOUR-0CDC4F5844^Start Menu^Programs^StartUp^Vongo Tray.lnk]
backup=c:\windows\pss\Vongo Tray.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Google\\Google SketchUp 6\\SketchUp.exe"=
"c:\\Documents and Settings\\Owner.YOUR-0CDC4F5844\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octosh ape.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/20/2009 5:29 AM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/20/2009 5:30 AM 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/20/2009 5:29 AM 285392]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\driv ers\keyscrambler.sys [11/20/2009 10:25 AM 115312]
S3 iComp;HP Analog TV Tuner;c:\windows\system32\drivers\p2usbwdm.sys [3/17/2006 6:34 PM 1544704]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - CLASSPNP_2
*Deregistered* - CLASSPNP_2
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contents of the 'Scheduled Tasks' folder
2009-11-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-28 10:44]
2009-11-21 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2009-09-21 19:46]
2009-11-21 c:\windows\Tasks\RegCure Startup.job
- c:\program files\RegCure\RegCure.exe [2009-09-21 19:46]
2009-11-20 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2009-09-21 19:46]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-11-20 21:57
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????u??????`?@?????L?@
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
GMER - Rootkit Detector and Remover
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A84C170]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74ebf28
\Driver\ACPI -> ACPI.sys @ 0xf735ecb8
\Driver\atapi -> atapi.sys @ 0xf72d2852
\Driver\iaStor -> iaStor.sys @ 0xf7208b58
IoDeviceObjectType -> SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
\Device\Harddisk0\DR0 -> SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
NDIS: Intel(R) PRO/1000 PL Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf7108bb0
PacketIndicateHandler -> NDIS.sys @ 0xf70f7a0d
SendHandler -> NDIS.sys @ 0xf710bb40
user & kernel MBR OK
************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\WININET.dll
- - - - - - - > 'lsass.exe'(1000)
c:\windows\system32\WININET.dll
.
Completion time: 2009-11-20 22:02
ComboFix-quarantined-files.txt 2009-11-21 03:01
Pre-Run: 43,331,559,424 bytes free
Post-Run: 44,329,562,112 bytes free
- - End Of File - - A4F76D260BC34C2D7C718DA3C767E585
Here is the Malware log:
Malwarebytes' Anti-Malware 1.41
Database version: 3206
Windows 5.1.2600 Service Pack 3
11/21/2009 10:14:42 AM
mbam-log-2009-11-21 (10-14-42).txt
Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 233108
Time elapsed: 1 hour(s), 6 minute(s), 5 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP622\A0091541.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
HiJackthis Log 
Linear Mode
