Rootkit and/or Trojan

rpg -- thanks for the response. Ran ComboFix script and log is attached.

ndis.sys is still infected -- surprise! surprise!

I run CCleaner to clean both files and registry as a matter of course, so that had already been done. Reran to be safe but nothing suspicious was deleted (only a few log files left to delete). I also delete files in \Documents and Settings\%username%\Local Settings\Temp folder(s). Learned years ago that was a favorite malware hiding place and neither CCleaner nor ATF Cleaner clean those folders.

It's Easter Sunday morning here so I won't be working on PC again until later in the day. Will upadte as I have more info.

Forgot to add -- verified those files in dllcache folder were MS signed files.

@greyknight17 -- thanks, but I have already deleted ndis.sys and "expanded" a new copy from XP CD.

FYI -- that link to Flash Disinfector is no longer valid. This one still works:  http://download.bleepingcomputer.com/sUBs/Flash_Disinfector.exe

Are you still having any signs of infection now? If not, go to Start > Run and type in combofix /u to remove it. Please read the below for guides on how to help prevent infections:

1. TonyKlein's article "So how did I get infected in the first place?"
http://www.spywareinfoforum.com/index.php?showtopic=60955
2. "Simple and easy ways to keep your computer safe and secure on the Internet"
http://www.bleepingcomputer.com/tutorials/tutorial82.html
3. "miekiemoes' "How to prevent Malware"
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html

@greyknight17 -- I'm very familiar with ComboFix including its removal. No matter what software I install and how much I advise customers, they continue to let their kids have full access to the internet. Could be because the parents are dependent on the kids for using the PC. They also aren't good about updating and/or renewing AV and anti-spyware software. Although I configure automatic updates, they won't leave PCs turned on when not in use.

I do occasionally need a Combofix script or peer input. I haven't attended Malware U yet and rely on the good folks here that have.

Some friendly advice -- when the questioner is a qualified expert, you might want to check their profile.

You didn't mention that the issue was resolved, so I wasn't sure if the issue was remaining.

Will take that advice and view the profile for those who are qualified experts in the future. But I don't see how that would help out in this case.

The jury is still out on whether the problem is resolved. Believe it is but waiting to see.

Without checking profiles, it's hard to determine one's level of expertise. I do appreciate your responding, but there's no need to provide basic information where it's not needed.

Did you update your link for Flash Disinfector? When you have "canned" responses or a list of links, it's good to validate links periodically.

Yes, the techsupportforum link hasn't been working for awhile...
Here's the working link that I've been using;
http://www.geekstogo.com/forum/redirect.php?url=http%3A%2F%2Fdownload.bleepingcomputer.com%2FsUBs%2FFlash_Disinfector.exe

Thanks for that link willcomp, :) I'll add that to my canned in case one link stops working.

No reinfections so far. Restore service is still not in registry and ndis.sys is still clean. I'll monitor for a while longer and then uninstall Combofix and call it cured.

Thanks for your help.

Appreciate the help. It seems to be clean. I'll monitor for another day and then uninstall ComboFix and pronounce it cured.