divocodec and CID popup adverts, help with removal

[bagpuss]

I have run several spyware finders including the most recent version of Spybot S+D and none of them have been able to identify the problem which I know started when I foolishly downloaded the play.divocodec program

the symptoms are background IE processes (I never use IE myself but firefox) and popup adverts using IE. the adverts are for varying topics but the header always starts with CID

Hijack this log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:16:48, on 20/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\BitTorrent_DNA\dna.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Itch ford four knob] C:\Documents and Settings\All Users\Application Data\third lies itch ford\Shim user.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [16 Sect] C:\DOCUME~1\Laura\APPLIC~1\STOREF~1\GreatArmy.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-4124372072-3762781024-2795490960-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7607 bytes


any assistance would be greatfully received

[bagpuss]

Kaspersky log

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, October 20, 2007 2:17:43 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 20/10/2007
Kaspersky Anti-Virus database records: 441392
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 60543
Number of viruses found: 2
Number of infected objects: 19
Number of suspicious objects: 0
Duration of the scan process: 00:25:41

Infected Object Name / Virus Name / Last Action
C:\2dbeaeb1aabf81b70d7b5b46802f\msxml4-KB927978-enu.log Object is locked skipped
C:\50047daa58841cd783\%temp%dd_msxml_retMSI.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2765fb41cd39df4ba673ea80117fe375_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\29fd7f216cc5e85fdfdcd7da69c8a1cc_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2d9584d73949d9336549d11908d3a4e9_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3580b066d655343ae30eb27bffa352c9_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3c31c5855d57cbdc150ea942f29de554_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4477237b79d71e3725c51ec231ce807a_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4732dbf5e6dbc4e721a63e28dd25db07_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\55cd606c2993d58f461cdf964b83afae_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6192d84d4d72660c5e680be2fdab8ddf_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6c094e0350d626cfc2faf8bee3fcb333_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\724ddaf6ceacdb82d5e6869f2a6c0628_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7c0dbbe91ebbc26164f384b2bf094f3e_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7e09eb5b908cf9c41559b169fe1e27e0_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7f2974891c50486b3a2df53cc70a8418_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\85573fe21c7c81759b6aac9bfb3a6a49_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9bbc6eb6192e4919c364eae808128f5e_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a6d74cf79f5c5f068c7b90f742b3ec05_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a859b97eafaabbce4498509f78ec6690_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a9d8f4faeea08b6f2e368f121d65d49b_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aa432c8d656409ba45f5914e72e6f7ce_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ac9037abfe7d21cadeda8be3e267b56e_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b348b8b9c8ac4f7d0ef1a2ca8828b940_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b44a5c2e1977141c10bb2603ad58a421_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bafb1d5d1501d9c135d425df2c581a45_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c7ac17dcd6ef96cd9f09157e9b0fed88_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cad9b1a4cacb8e291882fb827d4de012_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d42c1ad0463148c44ceb3d59f6136911_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e1893aaa0110de9447ac774f41b741d4_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fa2aca1cff883047ec97ce1bc6e717b7_82d19c70-d382-4726-a32a-104d90980355 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-02172007-104938.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\third lies itch ford\Shim user.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\browserstate-logs\log-20071019-230706-828.txt Object is locked skipped
C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\cert8.db Object is locked skipped
C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\history.dat Object is locked skipped
C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\key3.db Object is locked skipped
C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\parent.lock Object is locked skipped
C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Laura\Application Data\STOREFIVEMODE\ftwebcoy.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\Documents and Settings\Laura\Application Data\STOREFIVEMODE\GreatArmy.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\Documents and Settings\Laura\Application Data\STOREFIVEMODE\NURB ERROR HOLE.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\Documents and Settings\Laura\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{C8D3D4CD-12EE-4E5D-9527-73DBD3C81744} Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Application Data\Mozilla\Firefox\Profiles\rooj1mf2.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\History\History.IE5\MSHist012007101920071020\index.dat Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Temp\bis228.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Laura\My Documents\Downloads\on cd\seen\Heroes.S02E03.HDTV.XviD-XOR\xor-heroes.203.rar/Winzix.exe/file02 Infected: not-a-virus:FraudTool.Win32.WinZix.a skipped
C:\Documents and Settings\Laura\My Documents\Downloads\on cd\seen\Heroes.S02E03.HDTV.XviD-XOR\xor-heroes.203.rar/Winzix.exe/file14 Infected: Trojan.Win32.Obfuscated.en skipped
C:\Documents and Settings\Laura\My Documents\Downloads\on cd\seen\Heroes.S02E03.HDTV.XviD-XOR\xor-heroes.203.rar/Winzix.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\Documents and Settings\Laura\My Documents\Downloads\on cd\seen\Heroes.S02E03.HDTV.XviD-XOR\xor-heroes.203.rar RAR: infected - 3 skipped
C:\Documents and Settings\Laura\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Laura\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\WocUser\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\WocUser\NTUSER.DAT.LOG Object is locked skipped
C:\RECYCLER\S-1-5-21-4124372072-3762781024-2795490960-1008\Dc3.exe/file6 Infected: Trojan.Win32.Obfuscated.en skipped
C:\RECYCLER\S-1-5-21-4124372072-3762781024-2795490960-1008\Dc3.exe Inno: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP89\A0006327.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP89\A0006387.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP89\A0006395.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP89\A0006402.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP91\A0006466.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP92\A0006662.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP92\A0006788.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP93\A0006856.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{A55F123F-0D05-46C6-BB43-0ECD59082326}\RP93\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{DB392E56-5131-4F90-BAAC-9D95CBC60516}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

I apologize for the wait, your computer is infected with at least LOP/C2 Media.
http://research.sunbelt-software.com/threatdisplay.aspx?name=C2.lop&threatid=8144
There may be more, I can also see your System Restore is infected but it can not get back on your computer unless you do a System Restore...so do not.

If you have not resolved these issues, post a fresh HJT log since malware changes quickly and I will respond as soon as possible after that.

Thanks

[pskelley]

This topic is closed due to lack of a response.

If you need it re-opened please send me or a forum staff member a private message (pm) and provide a link to the thread; this applies only to the original topic starter.

Anyone else with similar problems please start a new topic.

Thanks