how to remove obfustat.xtg

I have created the log file per your instructions, but I'm unclear on your instructions on how to upload the log file.  I will paste the log file below.  Thank you for your help so far with this.

ComboFix 07-11-08.3 - Owner 2007-11-13 20:00:29.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.234 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Owner\Application Data\APPATC~1
C:\Documents and Settings\Owner\Application Data\SMANTE~1
C:\Documents and Settings\Owner\Application Data\SSEMBL~1
C:\Documents and Settings\Owner\Application Data\SSTEM3~1
C:\Documents and Settings\Owner\Application Data\SSTEM3~1\mshta.exe
C:\Documents and Settings\Owner\Application Data\SSTEM3~1\s?stem32\
C:\Documents and Settings\Owner\Application Data\tmp1299.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp12A.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp13EB.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp1632.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp17.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp18.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp19.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp1B.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp1C.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp1D.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp1EA.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp1ED.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp1F.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp20.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp2169.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp2285.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp2A.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp3E1.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp41.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp4F.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp528.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp6F9.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp73.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp7DD.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp7E.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp8.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp820.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp826.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp88.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp8E.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp9.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp93.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp948.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp98.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp9A.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmpA.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmpA29.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmpA5.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmpB5B.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmpDD2.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmpDE.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmpE4C.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmpFDE.tmp.exe
C:\Documents and Settings\Owner\My Documents\CROSOF~1.NET
C:\Documents and Settings\Owner\My Documents\DOBE~1
C:\Documents and Settings\Owner\My Documents\ICROSO~1.NET
C:\Documents and Settings\Owner\My Documents\PPPATC~1
C:\Documents and Settings\Owner\My Documents\SSEMBL~1
C:\Documents and Settings\Owner\My Documents\STEM32~1
C:\Documents and Settings\Owner\My Documents\YMANTE~1
C:\Program Files\asks~1
C:\Program Files\asks~1\m?dtc.exe
C:\Program Files\cas
C:\Program Files\Common Files\fnts~1
C:\Program Files\Common Files\icroso~1.net
C:\Program Files\fnts~1
C:\Program Files\stem~1
C:\WINDOWS\cookies.ini
C:\WINDOWS\fnts~1
C:\WINDOWS\mcroso~1
C:\WINDOWS\ssembl~1
C:\WINDOWS\system32\ecurit~1
C:\WINDOWS\system32\kdabxb.dll
C:\WINDOWS\ymbols~1

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_PWMDVPAX
-------\pwmdvpax


(((((((((((((((((((((((((   Files Created from 2007-10-14 to 2007-11-14  )))))))))))))))))))))))))))))))
.

2007-11-13 19:59      51,200      --a------      C:\WINDOWS\NirCmd.exe
2007-11-12 20:36      <DIR>      d--------      C:\Documents and Settings\Owner\Application Data\AVG7
2007-11-12 20:36      <DIR>      d--------      C:\Documents and Settings\LocalService\Application Data\AVG7
2007-11-12 20:36      <DIR>      d--------      C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-12 20:36      <DIR>      d--------      C:\Documents and Settings\All Users\Application Data\avg7
2007-11-12 14:28      <DIR>      d--------      C:\Documents and Settings\Owner\Application Data\U3
2007-11-12 14:08      6,058,496      -----c---      C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-12 14:08      2,455,488      -----c---      C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-12 14:08      459,264      -----c---      C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-12 14:08      383,488      -----c---      C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-12 14:08      267,776      -----c---      C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-12 14:08      63,488      -----c---      C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-12 14:08      52,224      -----c---      C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-12 14:08      13,824      -----c---      C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-12 14:01      33,792      --a--c---      C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-12 13:49      <DIR>      d--------      C:\Program Files\MSXML 4.0
2007-11-12 13:40      128,896      -----c---      C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-12 13:40      23,040      -----c---      C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-12 13:40      16,896      -----c---      C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-12 13:37      582,656      --a--c---      C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-12 13:22      55,333      --a------      C:\tmp1D.tmp.exe
2007-11-12 09:05      221,184      --a------      C:\WINDOWS\system32\wmpns.dll
2007-11-12 09:03      <DIR>      d--------      C:\WINDOWS\provisioning
2007-11-12 09:03      <DIR>      d--------      C:\WINDOWS\peernet
2007-11-12 08:58      <DIR>      d--------      C:\WINDOWS\ServicePackFiles
2007-11-12 08:43      <DIR>      d--------      C:\WINDOWS\EHome
2007-11-12 08:00      <DIR>      d--------      C:\WINDOWS\pss
2007-10-14 20:39      11,776      ---------      C:\WINDOWS\system32\spnpinst.exe
2007-10-14 20:39      4,569      ---------      C:\WINDOWS\system32\secupd.dat

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 01:15      ---------      d-----w      C:\Program Files\ItsDeductibleEX
2007-11-12 19:30      ---------      d-----w      C:\Program Files\Lavasoft
2007-11-12 19:30      ---------      d-----w      C:\Documents and Settings\Owner\Application Data\Lavasoft
2007-10-23 15:48      5,120      ----a-w      C:\WINDOWS\system32\drivers\eqnczdxc.dat
2007-10-23 15:48      18,688      ----a-w      C:\WINDOWS\system32\drivers\ghtbyaek.dat
2007-10-14 02:22      ---------      d-----w      C:\Program Files\Opera
2007-10-03 10:02      ---------      d-----w      C:\Program Files\Microsoft IntelliPoint
2007-10-02 05:50      ---------      d-----w      C:\Program Files\Windows Live Safety Center
2007-09-30 20:40      ---------      d-----w      C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-09-29 05:39      ---------      d-----w      C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware
2007-09-13 18:48      55,333      ----a-w      C:\tmp12.tmp.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0517A4BE-733A-44B7-9FC8-837B8B3C68AD}]
2003-07-16 15:26      101888      --a------      C:\WINDOWS\System32\dgsetu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25eb24ad-621c-4c21-bea4-d2d167980a15}]
                  C:\WINDOWS\system32\kbd__J.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDB1FA0C-64EE-664F-E459-4876146B0DC1}]
                  C:\WINDOWS\System32\cloqvl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-10-02 12:37]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-10-02 12:19]
"QBCD Autorun"="D:\autorun.exe" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"EPSON Stylus CX5400"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.exe" []
"magicolor 2300WStatusDisplay"="C:\WINDOWS\System32\MSTMON_J.EXE" [2002-12-21 01:37]
"tgcmd"="C:\Program Files\Support.com\BellSouth\hcenter.exe" [2004-07-25 13:45]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2005-02-17 21:44]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-05-05 00:28]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe" [2004-12-06 20:31]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-15 18:41]
"WUSB54Gv4"="C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe" [2004-04-19 09:19]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-11-12 20:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe" [2004-05-12 15:04]
"Evssstb"="C:\Documents and Settings\Owner\My Documents\?ppPatch\w?auboot.exe" []
"Nwaovvm"="C:\WINDOWS\?ssembly\r?ndll32.exe" []
"Hfju"="C:\Program Files\??stem\?hkdsk.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-04 00:12:18]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2006-03-18 15:06:02]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"VhOEZx"= {A4F57159-0E5F-DBF3-075F-AD029C10BB7E} - C:\WINDOWS\System32\ptz.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\kbd__J]
kbd__J.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a4f571f7]
rundll32.exe "C:\WINDOWS\mlkjji.dll",b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
"C:\Program Files\Softwin\BitDefender10\bdagent.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
"C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]
rundll32.exe "C:\WINDOWS\urpqqr.dll",forkonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WUSB54Gv4SVC"=2 (0x2)
"DomainService"=2 (0x2)
"VSSERV"=2 (0x2)
"bdss"=2 (0x2)
"LIVESRV"=2 (0x2)
"XCOMM"=2 (0x2)

R0 pwmdvpax;pwmdvpax;C:\WINDOWS\system32\drivers\ghtbyaek.dat
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
R2 MLPTDR_J;MLPTDR_J;\??\C:\WINDOWS\System32\MLPTDR_J.SYS
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
S3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;C:\WINDOWS\system32\DRIVERS\usb8023.sys
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\rt2500usb.sys
S4 WUSB54Gv4SVC;WUSB54Gv4SVC;"C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv4.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70109a7a-9155-11dc-a7c4-000d564f3253}]
\Shell\AutoRun\command - F:\LaunchU3.exe

*Newly Created Service* - PWMDVPAX
.
Contents of the 'Scheduled Tasks' folder
"2007-11-07 01:49:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-13 05:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At10.job"
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At11.job"
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 19:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 20:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 21:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 22:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 23:00:01 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 06:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 00:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-14 01:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 02:00:01 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 03:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 04:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 05:00:00 C:\WINDOWS\Tasks\At25.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 06:00:00 C:\WINDOWS\Tasks\At26.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 07:00:00 C:\WINDOWS\Tasks\At27.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 08:00:00 C:\WINDOWS\Tasks\At28.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 09:00:00 C:\WINDOWS\Tasks\At29.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 10:00:00 C:\WINDOWS\Tasks\At30.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 11:00:00 C:\WINDOWS\Tasks\At31.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At32.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At33.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At34.job"
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At35.job"
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At36.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At37.job"
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At38.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-12 19:00:00 C:\WINDOWS\Tasks\At39.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 08:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 20:00:00 C:\WINDOWS\Tasks\At40.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-12 21:00:00 C:\WINDOWS\Tasks\At41.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-12 22:00:00 C:\WINDOWS\Tasks\At42.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-12 23:00:01 C:\WINDOWS\Tasks\At43.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 00:00:00 C:\WINDOWS\Tasks\At44.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-14 01:00:00 C:\WINDOWS\Tasks\At45.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 02:00:01 C:\WINDOWS\Tasks\At46.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 03:00:00 C:\WINDOWS\Tasks\At47.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 04:00:00 C:\WINDOWS\Tasks\At48.job"
- C:\WINDOWS\System32\Kwjv4523.exe
"2007-11-13 09:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 10:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-13 11:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-12 18:17:43 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\System32\wQm4bGuM.exe
"2007-11-06 23:00:00 C:\WINDOWS\Tasks\Pareto UNS.job"
- C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 20:05:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-13 20:07:02 - machine was rebooted
.
      --- E O F ---

Oh boy that's quite a mess you have there...

OK, for uploading files go to the link I provided.
http://www.ee-stuff.com
Sign in if you haven't already.
Click on the "Experts Area" tab.
Click on "Upload a new file"
When the new window pops up. Click "Browse" and find the file to be uploaded. Then post the link to it back here.

Please don't post any other logs here.

Give me some time to go over that combofix log and I'll get back to you either later this evening or tomorrow with a script that you will need to run. Combofix did get quite a bit but you still have quite a mess there. In the meantime, please run HijackThis and upload that log to ee-stuff.

Download here:
http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php
Run it, do a system scan and save a log file. Upload the log file that's produced.

here is the shortcut
do you think I might be better off reloading the OS?

http://www.ee-stuff.com/Expert/Upload/getFile.php?fid=5574

thanks.

here is the hijack this log

http://www.ee-stuff.com/Expert/Upload/getFile.php?fid=5576

thank you

Before we do anything with combofix I would suggest you run SDFix first. Then combofix again.

Please download SDFix and save it to your Desktop.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please upload the contents to http://www.ee-stuff.com.

Then run combofix again after running SDFix. Upload that log and a Hijackthis log.

Good morning,
I got tied up and couldn't get back to this until this morning.
The log files are as follows:
http://www.ee-stuff.com/Expert/Upload/viewFilesQuestion.php?qid=22958170
http://www.ee-stuff.com/Expert/Upload/viewFilesQuestion.php?qid=22958170
http://www.ee-stuff.com/Expert/Upload/viewFilesQuestion.php?qid=22958170

Many thanks for all of help to this point.