Expert: Brian Benosky - 4/2/2008

Question
QUESTION: it said i had to aska new question from all the follow - ups. but i can not find that file (sysdata.xml) anywhere... i thought maybe i didnt have it so i restarted my laptop after following before that and it went to the blue screen again but this time i had a hard time restarting. is there any other way to find that file??
sry for all the questions, im not good at computers

ANSWER: Hi Meghan

Did you unhide your files?  
   * Click Start.
   * Open My Computer.
   * Select the Tools menu and click Folder Options.
   * Select the View Tab.
   * Under the Hidden files and folders heading select Show hidden files and folders.
   * Uncheck the Hide protected operating system files (recommended) option.
   * Click Yes to confirm.
   * Click OK.


Brian

---------- FOLLOW-UP ----------

QUESTION: i followed those steps and found two of those files, deleted them and then restarted my laptop. i ran spybot again and had about 10 things come up. i tried to delete them but the same blue screen came up.

ANSWER: Hi Meghan

You may have hardware or driver issues that are affecting the running of these programs successfully.  Let's try two more malware removal programs to see if you get the same blue screen with these:

Please download ComboFix and save to your desktop:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    Note: It is important that it is saved directly to your desktop
    Close any open browsers.
    Double click on combofix.exe and follow the prompts.
    When it's finished it will produce a log.
    Post the contents of the C:\ComboFix.txt into your next reply.
    Note: Do not mouseclick combofix's window while it's running.
    That may cause the program to freeze/hang.

After running ComboFix, please download Dr.Web's CureIt from here:

ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe

Run the utility and press the "Start" button in the opened window. Confirm the launch by pressing the "OK" button and wait for the scanning results of the main memory and startup files. Select the Complete scan  and press the "Start scanning" button on the scanner right.

When finished, please post me the ComboFix log located at C:\ComboFix.txt and also a fresh HJT scan log.

Brian

---------- FOLLOW-UP ----------

QUESTION: ComboFix:

ComboFix 08-04-01.2 - Meg 2008-04-01 23:29:54.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.640 [GMT -5:00]
Running from: C:\Documents and Settings\Meg\Desktop\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Meg\Application Data\macromedia\Flash Player\#SharedObjects\39TE27DS\iforex.com
C:\Documents and Settings\Meg\Application Data\macromedia\Flash Player\#SharedObjects\39TE27DS\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Meg\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Meg\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Program Files\PlayMP3z
C:\Program Files\PlayMP3z\PlayMP3.exe
C:\Program Files\PlayMP3z\uninstall.exe
C:\WINDOWS\system32\adefe.ini
C:\WINDOWS\system32\adefe.ini2
C:\WINDOWS\system32\cbeeg.ini
C:\WINDOWS\system32\cbeeg.ini2
C:\WINDOWS\system32\cedgh.ini
C:\WINDOWS\system32\cedgh.ini2
C:\WINDOWS\system32\defii.ini
C:\WINDOWS\system32\defii.ini2
C:\WINDOWS\system32\gjlnn.ini
C:\WINDOWS\system32\gjlnn.ini2
C:\WINDOWS\system32\hgggefg.dll
C:\WINDOWS\system32\ijmoq.ini
C:\WINDOWS\system32\ijmoq.ini2
C:\WINDOWS\system32\jihhk.ini
C:\WINDOWS\system32\jihhk.ini2
C:\WINDOWS\system32\mloqr.ini
C:\WINDOWS\system32\mloqr.ini2
C:\WINDOWS\system32\nnoqr.ini
C:\WINDOWS\system32\nnoqr.ini2
C:\WINDOWS\system32\nonpo.ini
C:\WINDOWS\system32\nonpo.ini2
C:\WINDOWS\system32\prsut.ini
C:\WINDOWS\system32\prsut.ini2
C:\WINDOWS\system32\qpqru.ini
C:\WINDOWS\system32\qpqru.ini2
C:\WINDOWS\system32\srsut.ini
C:\WINDOWS\system32\srsut.ini2
C:\WINDOWS\system32\wayay.ini
C:\WINDOWS\system32\wayay.ini2
C:\WINDOWS\system32\wvuvw.ini
C:\WINDOWS\system32\wvuvw.ini2
C:\WINDOWS\system32\yxwxx.ini
C:\WINDOWS\system32\yxwxx.ini2

.
(((((((((((((((((((((((((   Files Created from 2008-03-02 to 2008-04-02  )))))))))))))))))))))))))))))))
.

2008-04-01 23:19 . 2008-04-01 23:19   315,616   --a------   C:\WINDOWS\system32\urqpq.dll
2008-04-01 20:05 . 2008-04-01 20:05   315,616   --a------   C:\WINDOWS\system32\hgdec.dll
2008-04-01 18:43 . 2008-04-01 18:43   315,616   --a------   C:\WINDOWS\system32\yayaw.dll
2008-04-01 15:53 . 2008-04-01 15:53   315,616   --a------   C:\WINDOWS\system32\khhij.dll
2008-04-01 14:41 . 2008-04-01 14:42   315,616   --a------   C:\WINDOWS\system32\opnon.dll
2008-04-01 13:31 . 2008-04-01 13:31   315,616   --a------   C:\WINDOWS\system32\efeda.dll
2008-03-31 17:57 . 2008-03-31 17:57   315,696   --a------   C:\WINDOWS\system32\nnljg.dll
2008-03-31 15:06 . 2008-03-31 15:06   315,696   --a------   C:\WINDOWS\system32\tusrs.dll
2008-03-31 14:01 . 2008-03-31 14:01   315,696   --a------   C:\WINDOWS\system32\rqonn.dll
2008-03-30 19:06 . 2008-03-30 19:06   315,664   --a------   C:\WINDOWS\system32\qomji.dll
2008-03-30 15:54 . 2008-03-30 15:54   315,664   --a------   C:\WINDOWS\system32\tusrp.dll
2008-03-30 15:44 . 2008-03-30 15:44   <DIR>   d--------   C:\Program Files\Trend Micro
2008-03-30 04:12 . 2008-03-30 04:12   315,664   --a------   C:\WINDOWS\system32\wvuvw.dll
2008-03-30 03:23 . 2008-03-30 03:23   <DIR>   d--------   C:\Program Files\Lavasoft
2008-03-30 03:23 . 2008-03-30 03:23   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-30 03:22 . 2008-03-30 03:22   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2008-03-30 02:56 . 2008-03-30 02:56   315,632   --a------   C:\WINDOWS\system32\rqolm.dll
2008-03-29 23:26 . 2008-03-29 23:26   315,632   --a------   C:\WINDOWS\system32\xxwxy.dll
2008-03-29 23:06 . 2008-03-29 23:06   315,632   ---------   C:\WINDOWS\system32\geebc.dll
2008-03-29 18:47 . 2008-03-29 19:09   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-03-29 00:07 . 2008-03-29 00:07   315,568   ---------   C:\WINDOWS\system32\iifed.dll
2008-03-27 16:05 . 2008-03-30 19:53   <DIR>   d--------   C:\Program Files\Spybot - Search & Destroy
2008-03-27 16:05 . 2008-03-30 20:05   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-24 13:04 . 2008-03-24 13:04   <DIR>   d--------   C:\Program Files\FBrowsingAdvisor
2008-03-24 13:04 . 2008-03-24 13:04   <DIR>   d--------   C:\Program Files\FBrowserAdvisor
2008-03-09 20:21 . 2008-04-01 23:01   <DIR>   d--------   C:\Program Files\ContextProgram

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-29 07:15   ---------   d-----w   C:\Program Files\LimeWire
2008-03-29 07:14   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-03-15 00:01   ---------   d--h--r   C:\Documents and Settings\Meg\Application Data\yahoo!
2008-03-15 00:01   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-03-14 22:17   ---------   d-----w   C:\Program Files\Logitech
2008-03-02 21:50   ---------   d-----w   C:\Program Files\Windows Live
2008-02-26 05:09   ---------   dcsh--w   C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-26 04:59   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-02-24 22:07   29,184   ----a-w   C:\Documents and Settings\Meg\Application Data\GDIPFONTCACHEV1.DAT
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C780C51-64D2-4797-B3B4-AF436ADC3600}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{137219FD-FF77-4402-8535-B83222A42E67}]
2008-04-01 20:05   315616   --a------   C:\WINDOWS\system32\hgdec.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{252CC02D-4868-40C6-81FB-B403E9B06BD9}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{303CB5F9-3CE2-443C-B168-F3A0011A36CC}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{451D27F9-7228-4F9A-B38F-F3CF8215F1A2}]
2008-04-01 23:19   315616   --a------   C:\WINDOWS\system32\urqpq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6571D352-F770-43A2-9165-7F91287BAEFF}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D40C8CF-13D8-4A1B-A7CA-DB7E6958050D}]
2008-03-29 00:07   315568   ---------   C:\WINDOWS\system32\iifed.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{829499D7-D171-4657-A917-399253F7F533}]
2008-04-01 13:31   315616   --a------   C:\WINDOWS\system32\efeda.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85A611CA-CA0F-469B-8220-B70221A545BB}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BACF0991-FA8A-4401-AC3E-DB6C9967044E}]
2008-04-01 14:42   315616   --a------   C:\WINDOWS\system32\opnon.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C85A992C-5B2D-4C6D-8079-DADFCA94E298}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC495B65-9165-4FC8-AFB4-0AA66301B1A7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5B46DB0-F006-411F-A540-9154726B3233}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E4D1D56C-3EC9-2F5D-FAA3-4112CCDD61DC}]
2007-12-30 15:48   1019904   --a------   C:\Program Files\ContextProgram\ContextProgram-1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E5FA050F-5A8A-4EE2-8C93-F825B10721ED}]
2008-04-01 18:43   315616   --a------   C:\WINDOWS\system32\yayaw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FAB1BEBE-C2A3-4B7E-8A02-F39AEF7D6E06}]
2008-04-01 15:53   315616   --a------   C:\WINDOWS\system32\khhij.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 03:32 65536]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-10-14 17:29 88203 C:\WINDOWS\agrsmmsg.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-09 22:14 15473664 C:\WINDOWS\RTHDCPL.exe]
"NDSTray.exe"="NDSTray.exe" []
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 08:10 122940]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 19:13 122880]
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-11-10 13:24 73728]
"THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-11-23 19:32 352256]
"TFncKy"="TFncKy.exe" []
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-18 18:57 188416]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-07-22 22:46 401408]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-07-22 22:47 385024]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-15 17:54 761947]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-07 22:02 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-07 21:59 77824]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-07 22:03 114688]
"TPSMain"="TPSMain.exe" [2005-05-31 21:00 282624 C:\WINDOWS\system32\TPSMain.exe]
"CFSServ.exe"="CFSServ.exe" []
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36 256576]

C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\
IEHOME.LNK - C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat [2006-06-27 08:39:00 298]

C:\Documents and Settings\Meg\Start Menu\Programs\Startup\
Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2004-06-12 00:57:52 59080]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2003-07-12 10:56:56 83360]
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2005-11-24 17:36:40 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgggefg]
hgggefg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2005-07-22 22:46 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   REG_MULTI_SZ      msv1_0 C:\WINDOWS\system32\urqpq.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Toshiba\\ConfigFree\\CFXFER.exe"=

S3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2004-05-17 18:18]

.
Contents of the 'Scheduled Tasks' folder
"2007-12-25 17:55:29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 23:36:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-04-01 23:38:16 - machine was rebooted
ComboFix-quarantined-files.txt  2008-04-02 04:38:13
Pre-Run: 78,604,726,272 bytes free
Post-Run: 81,176,735,744 bytes free
.
2008-03-30 22:15:17   --- E O F ---  


HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:20:20 AM, on 4/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://shoptoshiba.ca/welcome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - S-1-5-18 Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'SYSTEM')
O4 - .DEFAULT Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
O4 - .DEFAULT User Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Meg\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://nb.dns-look-up.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe

--
End of file - 8496 bytes

Answer
Hi Meghan

Open HJT and do a Scan only.  Place a check mark next to the following item, then click the Fix Checked button:

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Meg\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)

It looks like you had a Vundo Trojan infection.  Vundo (also known as Virtumonde or Virtumondo) is a Trojan horse that is known to cause popups and advertising for rogue antispyware programs. It infects your computers by exploiting a vulnerability in Sun Java 1.5 (which you are running) and earlier versions. Many of the popups advertise programs including (but not limited to) Sysprotect, Storage Protector and WinFixer.  You need to update your Java Runtime Environment.  Also, it seems that you don't use an anti-virus scanner or your scanner is not active. Only an anti-virus scanner can protect you against new viruses.  Go to the link below for some anti-virus program suggestions:
http://forum.hijackthis.de/showthread.php?t=8897

To uninstall the Java Runtime Environment (JRE) from your system, use the Add/Remove Programs utility in the Microsoft Windows Control Panel:

  1. Click Start
  2. Select Settings
  3. Select Control Panel
  4. Double click the Add/Remove Programs control panel icon
  5. The Add/Remove control panel displays a list of software on your system, including any Java software products that are on your computer. Select the Java Runtime Environment that you want to uninstall by clicking on it, and then click the Remove button.

Next go to the following page to install the latest version of Java:
http://www.java.com/en/download/windows_xpi.jsp?locale=en&host=www.java.com

I hope I have helped you to solve this problem.  If you have further questions, just let me know.

Brian