Malware Attack...Please Help

[Smoke_O]

I have malware on my computer and it disabled ctr+alt+delete, it stalls web pages, it wont let me open and run various malware removers like Spybot and Kapersky. Here is my HJT and Malwarebytes logs.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:21:45 PM, on 6/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\webHancer\Programs\whagent.exe
C:\WINDOWS\mrofinu72.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\PROGRA~1\ASEMBL~1\tracert.exe
C:\Program Files\GetModule\GetModule18.exe
C:\WINDOWS\system32\??pPatch\??ool32.exe
C:\Program Files\GetPack\GetPack18.exe
C:\Program Files\Svconr\Svconr.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\Spcron\Spc.dll
O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
O2 - BHO: (no name) - {DE3DBC48-76D0-0352-FB3C-78A291E81E96} - C:\WINDOWS\system32\gwsoejm.dll
O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKCU\..\Run: [Microsoft Windows Installer] C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [GetModule18] "C:\Program Files\GetModule\GetModule18.exe"
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O4 - HKCU\..\Run: [GetPack18] "C:\Program Files\GetPack\GetPack18.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - HKCU\..\Run: [Svconr] C:\Program Files\Svconr\Svconr.exe
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T2x1aWdibw\command.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 16376 bytes

[Smoke_O]

Malwarebytes' Anti-Malware 1.17
Database version: 861

10:08:39 PM 6/16/2008
mbam-log-6-16-2008 (22-08-26).txt

Scan type: Full Scan (C:\|)
Objects scanned: 240314
Time elapsed: 7 hour(s), 16 minute(s), 30 second(s)

Memory Processes Infected: 4
Memory Modules Infected: 3
Registry Keys Infected: 46
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 13
Files Infected: 112

Memory Processes Infected:
C:\WINDOWS\mrofinu72.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\GetModule\GetModule18.exe (Adware.ISM) -> No action taken.
C:\Program Files\GetPack\GetPack18.exe (Adware.ISM) -> No action taken.
C:\Program Files\webHancer\Programs\whagent.exe (Adware.Webhancer) -> No action taken.

Memory Modules Infected:
C:\Program Files\webHancer\Programs\whiehlpr.dll (Adware.WebHancer) -> No action taken.
C:\WINDOWS\system32\gwsoejm.dll (Adware.ClickSpring) -> No action taken.
C:\Program Files\webHancer\Programs\webhdll.dll (Adware.Webhancer) -> No action taken.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj.1 (Adware.WebHancer) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{c89435b0-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{c8cb3870-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fcaddc14-bd46-408a-9842-cdbe1c6d37eb} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} (Fake.Dropped.Malware) -> No action taken.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Adware.ISM) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{de3dbc48-76d0-0352-fb3c-78a291e81e96} (Adware.ClickSpring) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{de3dbc48-76d0-0352-fb3c-78a291e81e96} (Adware.ClickSpring) -> No action taken.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ism (Adware.ISM) -> No action taken.
HKEY_CURRENT_USER\Software\QdrPack (Adware.ISM) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISM (Adware.ISM) -> No action taken.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> No action taken.
HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo (Adware.PurityScan) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runner1 (Trojan.Downloader) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GetModule18 (Adware.ISM) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GetPack18 (Adware.ISM) -> No action taken.
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\webHancer Agent (Adware.Webhancer) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Installer (Trojan.Agent) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
C:\Program Files\dynamic toolbar (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache (Adware.2020search) -> No action taken.
C:\Program Files\Outerinfo (Adware.Outerinfo) -> No action taken.
C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> No action taken.
C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> No action taken.
C:\Program Files\webHancer (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs (Adware.Webhancer) -> No action taken.
C:\Program Files\ISM (Adware.ISM) -> No action taken.
C:\Program Files\QdrPack (Adware.ISM) -> No action taken.
C:\Program Files\GetPack (Trojan.Agent) -> No action taken.
C:\Program Files\iCheck (Trojan.Agent) -> No action taken.
C:\Program Files\GetModule (Trojan.Agent) -> No action taken.

Files Infected:
C:\WINDOWS\mrofinu72.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\GetModule\GetModule18.exe (Adware.ISM) -> No action taken.
C:\Program Files\GetPack\GetPack18.exe (Adware.ISM) -> No action taken.
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> No action taken.
C:\Program Files\webHancer\Programs\whiehlpr.dll (Adware.WebHancer) -> No action taken.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\gettpa118.exe (Adware.ISM) -> No action taken.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\ismtpa17.exe (Adware.ISM) -> No action taken.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\syswcc32.exe (Adware.Webhancer) -> No action taken.
C:\Program Files\iCheck\iCheck.exe (Adware.ISM) -> No action taken.
C:\Program Files\iCheck\Uninstall.exe (Adware.ISM) -> No action taken.
C:\Program Files\Outerinfo\FF\components\FF.dll (Adware.ClickSpring) -> No action taken.
C:\Program Files\QdrPack\bostrupd.exe (Trojan.Agent) -> No action taken.
C:\Program Files\QdrPack\QdrPack17.exe (Adware.ISM) -> No action taken.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP510\A0067159.exe (Adware.WebHancer) -> No action taken.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP510\A0067160.dll (Adware.WebHancer) -> No action taken.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP510\A0067161.dll (Adware.WebHancer) -> No action taken.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP510\A0068172.exe (Adware.ISM) -> No action taken.
C:\WINDOWS\system32\gwsoejm.dll (Adware.ClickSpring) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\1tb.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\celebs.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\ebay.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\ebaysm.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\ErrorLog.txt (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\games.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\gotb.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\highlight.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\hotstuff.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\hotstuffsm.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\movies.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\music.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\news.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\R1tb.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\radio.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\REALBARTB1115.cfg (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\sports.bmp (Adware.2020search) -> No action taken.
C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> No action taken.
C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> No action taken.
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> No action taken.
C:\Program Files\webHancer\Programs\license.txt (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\readme.txt (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\sporder.dll (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\webhdll.dll (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\whagent.exe (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\whagent.ini (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\whinstaller.exe (Adware.Webhancer) -> No action taken.
C:\Program Files\ISM\Uninstall.exe (Adware.ISM) -> No action taken.
C:\Program Files\GetPack\dictame.gz (Trojan.Agent) -> No action taken.
C:\Program Files\GetPack\trgtame.gz (Trojan.Agent) -> No action taken.
C:\Program Files\GetModule\dicik.gz (Trojan.Agent) -> No action taken.
C:\Program Files\GetModule\kwdik.gz (Trojan.Agent) -> No action taken.
C:\Program Files\GetModule\pckik.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\explore.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\iexplorer.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\x.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\y.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\xxxvideo.hta (Trojan.Agent) -> No action taken.
C:\WINDOWS\default.htm (Trojan.Agent) -> No action taken.
C:\WINDOWS\svchost32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\loader.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\internet.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\accesss.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\astctl32.ocx (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\avpcc.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\clrssn.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\cpan.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\ctfmon32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\ctrlpan.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\directx32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\dnsrelay.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\editpad.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\explorer32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\funniest.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\funny.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\gfmnaaa.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\helpcvs.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\iedll.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\inetinf.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\msconfd.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\msspi.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\mssys.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\msupdate.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\mswsc10.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\mswsc20.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\mtwirl32.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\notepad32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\olehelp.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\qttasks.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\quicken.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\rundll16.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32\clbdll.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\000070.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\000080.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\rundll32.vbe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\searchword.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\sistem.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\svcinit.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\systeem.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\systemcritical.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\time.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\users32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\waol.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\win32e.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\win64.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\winajbm.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\window.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\winmgnt.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\xplugin.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32\drivers\clbdriver.sys (Rootkit.Agent) -> No action taken.
C:\Program Files\Common Files\Yazzle1552OinAdmin.exe (Adware.PurityScan) -> No action taken.
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe (Adware.PurityScan) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\dat61.tmp (Trojan.Agent) -> No action taken.

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Seems like you are posting again and again, are you paying any attention to the information you are being provided by these helpers? Stuff happens, but you should not be getting infected and posting again and again.

If you still need help, read the directions posted above and pinned to the top of this forum, especially this one:

Do NOT run 'FIXES' before helpers have analyzed the HJT log
http://forums.spybot.info/showthread.php?t=16806

Malwarebytes' Anti-Malware 1.17
10:08:39 PM 6/16/2008
No action taken <<< see this

Run MBAM again and choose to delete what it finds, then restart the computer. Once you have done that, post a new HJT log.

Thanks

[Smoke_O]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:35:13 PM, on 6/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ASEMBL~1\tracert.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9138 bytes

[pskelley]

I am sorry, I should have specified the MBAM log, please scan again, remove what it finds and post the scan results.

Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post contents of that file & a new HJT log in your next reply.

Make sure the HJT log is created after you have finished removing what MBAM located and restarted your computer.

Thanks

[Smoke_O]

Malwarebytes' Anti-Malware 1.17
Database version: 861

11:41:10 PM 6/22/2008
mbam-log-6-22-2008 (23-41-08).txt

Scan type: Full Scan (C:\|)
Objects scanned: 239306
Time elapsed: 4 hour(s), 24 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{dc3be418-7081-5c50-ac3c-78a291ef4fce} (Adware.ClickSpring) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc3be418-7081-5c50-ac3c-78a291ef4fce} (Adware.ClickSpring) -> Quarantined and deleted successfully.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo (Adware.PurityScan) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Outerinfo\FF\components\FF.dll (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP517\A0069580.dll (AdWare.CommAd) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP518\A0069712.exe (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pvieawv.dll (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\OiUninstaller.exe (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\outerinfo.ico (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clbinit.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

[pskelley]

Let me take a moment to explain how this works. HJT is a diagnostic tool that shows a picture of the places malware hackers usually place their junk. It cannot show it all, it would have to be hugh. We use the tools like MBAM to reach hidden malware, but we need to look at the HJT log to see what the tool accomplished. In summation, and I usually ask for it as I did here:

Please post contents of that file & a new HJT log in your next reply
I always need to see a HJT log after a tool has been run.

So...if you would be so kind as to post a fresh HJT log that was run after MBAM removed what junk it could, I will look at see what else may be needing removal from your computer. I always appreciate feedback, so add any comments you think will help.

Thanks...Phil

[Smoke_O]

Hello, you keep saying HJT is that the HijackTrend log. if so do you want BOTH the HijackTrend log and MBAM log? Also MBAM log wasnt finding the viruses so I ran Kaspersky and it found loads of junk. Should I post that too? Thanks

[pskelley]

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

All I need is the HJT log, the MBAM log is posted.

If it is from the Kaspersky Online Scan, post it.

[Smoke_O]

KASPERSKY ONLINE SCANNER REPORT
Wednesday, June 25, 2008 10:09:01 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/06/2008
Kaspersky Anti-Virus database records: 884005
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 189122
Number of viruses found: 44
Number of infected objects: 253
Number of suspicious objects: 0
Duration of the scan process: 04:22:27

Infected Object Name / Virus Name / Last Action
C:\23100247.exe Infected: Backdoor.Win32.Haxdoor.je skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea563f5ed0b8ea72081a19b9b561dd25_9e2917f4-b3ab-4a25-8f86-18864f18394f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\ACS\1.0\ph Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\ACS\1.0\variable Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\idb\OOluigbo\mydb.idx Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\idb\OOluigbo\style.lst Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\idb\OOluigbo\toolbar.lst Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\idb\SNMaster.idx Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\organize\CACHE\ooluig02 Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\organize\ooluigbo Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\organize\ooluigbo.abi Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\organize\ooluigbo.aby Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\aolstderr.txt Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\aolstdout.txt Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\aoltsmon.lock Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\cache.db Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\server.lock Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\UserProfiles\All Users\BFTS\BFTSDatabase.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\ACZ\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\AGE\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5146.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5146.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5146.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5146.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51538.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51538.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51538.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51538.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516A9.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516A9.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516A9.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516A9.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51C.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51C.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51C.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51C.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs538.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs538.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs538.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs538.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs557.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs557.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs557.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs557.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs56420.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs56420.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs56420.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs56420.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5C48.tmpbsx32\motor2b.exe/data0002 Infected: Trojan-Downloader.Win32.VB.df skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5C48.tmpbsx32\motor2b.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\cfg2F.tmpcfgmgr52\bbi2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\CQE\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\ISZ\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\JND\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\KAE\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.u skipped
C:\Documents and Settings\Owner\Local Settings\Temp\MOL\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.u skipped
C:\Documents and Settings\Owner\Local Settings\Temp\QVG\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\ROH\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\SMK\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\SMV\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\SQC\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\WGK\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[2].cab/MediaGatewayX.dll Infected: not-a-virus:AdWare.Win32.WinAD.bv skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[2].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[3].cab/MediaGatewayX.dll Infected: not-a-virus:AdWare.Win32.WinAD.bv skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[3].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[4].cab/MediaGatewayX.dll Infected: not-a-virus:AdWare.Win32.WinAD.bv skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[4].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\58SB9XG5\emCraft1[1].cab/ATPartners.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.c skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\58SB9XG5\emCraft1[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\Browser_Plugin[1].cab/242656.exe Infected: Trojan-Downloader.Win32.Small.fz skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\Browser_Plugin[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\STATS4[1].CHM/stats4.htm Infected: Trojan-Downloader.JS.Psyme.n skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\STATS4[1].CHM CHM: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\STATS4[2].CHM/stats4.htm Infected: Trojan-Downloader.JS.Psyme.n skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\STATS4[2].CHM CHM: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IRMZMXYN\hp1[1].exe/data0002 Infected: not-a-virus:AdWare.Win32.BookedSpace.c skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IRMZMXYN\hp1[1].exe NSIS: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M97W5CB6\downloader[1].ocx Infected: Trojan-Downloader.Win32.VB.mk skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M97W5CB6\emCraft1[1].cab/ATPartners.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.c skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M97W5CB6\emCraft1[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\popup[1].php Infected: Trojan-Downloader.JS.IstBar.q skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[1].txt/index.exe Infected: Trojan-Dropper.Win32.Delf.ev skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[1].txt/index.htm Infected: Trojan-Downloader.VBS.Psyme.a skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[1].txt CHM: infected - 2 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[2].txt/index.exe Infected: Trojan-Dropper.Win32.Delf.ev skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[2].txt/index.htm Infected: Trojan-Downloader.VBS.Psyme.a skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[2].txt CHM: infected - 2 skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\Apps.Lst Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\art.idx Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\sap.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\spool.lst Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\sysnews.lst Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.32158 Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.40157/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.40157 NSIS: infected - 1 skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.70062 Infected: Trojan-Downloader.Win32.PurityScan.gb skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Verizon\VSP\client_gateway.log Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\History\History.IE5\MSHist012008062520080626\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt101.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt108.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt10F.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1106.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt117.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt11E.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt125.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt12C.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt133.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt13A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1409.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt142.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt14A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt151.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt158.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt15F.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt166.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt16D.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt174.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt17B.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt182.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1850.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt18A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt191.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt198.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1A1.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1A8.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1AF.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1B.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1B6.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1BD.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1C30.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1C4.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1CB.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1D3.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1DA.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1E1.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1E8.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1EA.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1F5D.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt20F.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt22.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt22C.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt22D9.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt25.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt253.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt25A0.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt260.tmp/stream/data0008 Infected: not-a-virus:FraudTool.Win32.WinFixer.i skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt260.tmp/stream Infected: not-a-virus:FraudTool.Win32.WinFixer.i skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt260.tmp NSIS: infected - 2 skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt276.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2872.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt297.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2AB.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2BF.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2C.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2D4.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2D44.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2E8.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2FD.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt306C.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt311.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt325.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt3290.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt33.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt3A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt47.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt55.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt568.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt60.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt6A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt6A2.tmp Infected: Trojan.Win32.Pakes.czg skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt71.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt79.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt82.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt8A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt92.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt9A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttA3.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttAD.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttB4.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttBB.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttC2.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttC9.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttD0.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttD9.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttDAC.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttE2.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttEB.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttF3.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttFA.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\bbbbti.exe Infected: not-virus:Hoax.Win32.Renos.daw skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\FTJs.exe Infected: Rootkit.Win32.HideProc.i skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\ntuser.dat.LOG Object is locked skipped
C:\I386\DRIVER.CAB/i8042prt.sys Infected: not-a-virus:Monitor.Win32.UberKeylogger.b skipped
C:\I386\DRIVER.CAB CAB: infected - 1 skipped
C:\Program Files\aѕsembly\tracert.exe Infected: Trojan-Downloader.Win32.Agent.kwg skipped
C:\Program Files\CA\PPRT\logs\2008-06-25.csv Object is locked skipped
C:\Program Files\Norton AntiVirus\Quarantine\218B5514 Infected: Trojan-Downloader.Win32.Small.fz skipped
C:\Program Files\Norton AntiVirus\Quarantine\4D952FE3 Infected: not-a-virus:Porn-Dialer.Win32.RTSMini skipped
C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe Infected: not-a-virus:FraudTool.Win32.WinFixer.i skipped
C:\Program Files\vol_toolbar\vol_toolbar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.p skipped
C:\Program Files\Windows Media Player\wmplayer.exe.tmp/data0002 Infected: not-a-virus:AdWare.Win32.BookedSpace.c skipped
C:\Program Files\Windows Media Player\wmplayer.exe.tmp NSIS: infected - 1 skipped
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\SuppLog.txt Object is locked skipped
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP520\change.log Object is locked skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP715\A0083276.exe Infected: not-a-virus:AdWare.Win32.Bestofer.d skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084207.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.j skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084211.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.j skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084213.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084214.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084214.exe/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.y skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084214.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084216.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Driver Cache\i386\driver.cab/i8042prt.sys Infected: not-a-virus:Monitor.Win32.UberKeylogger.b skipped
C:\WINDOWS\Driver Cache\i386\driver.cab CAB: infected - 1 skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{49D95C30-383B-4AAF-A84E-64F8B819F92E}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\1xhFPd.syz Infected: Rootkit.Win32.HideProc.i skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\DGPSZv.syz Infected: Rootkit.Win32.HideProc.i skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\lphcefhj0er0g.exe Infected: Trojan.Win32.Pakes.deo skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\ΑрpPatch\ѕрool32.exe Infected: not-a-virus:AdWare.Win32.PurityScan.id skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINNT\$NtUninstallKB824141$\user32.dll Object is locked skipped
C:\WINNT\$NtUninstallKB824141$\win32k.sys Object is locked skipped
C:\WINNT\$NtUninstallKB828028$\msasn1.dll Object is locked skipped
C:\WINNT\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped
C:\WINNT\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped
C:\WINNT\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped
C:\WINNT\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped
C:\WINNT\Ajccylqdgcy.hba\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Aowctdjnz.gdd\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Aowctdjnz.gdd\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Aowctdjnz.gdd\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Aowctdjnz.gdd\sah.exe NSIS: infected - 3 skipped
C:\WINNT\asatbano.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\Bdgwceuxq.drz\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Bdgwceuxq.drz\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Bdgwceuxq.drz\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Bdgwceuxq.drz\sah.exe NSIS: infected - 3 skipped
C:\WINNT\bs7beta.exe Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\Btlhpmv.egd\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Btlhpmv.egd\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Btlhpmv.egd\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Btlhpmv.egd\sah.exe NSIS: infected - 3 skipped
C:\WINNT\cmpmyh.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.ai skipped
C:\WINNT\Cmrhrwt.hrc\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cmrhrwt.hrc\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cmrhrwt.hrc\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cmrhrwt.hrc\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Cpqeaygvf.ebo\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cpqeaygvf.ebo\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cpqeaygvf.ebo\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cpqeaygvf.ebo\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Driver Cache\i386\driver.cab/i8042prt.sys Infected: not-a-virus:Monitor.Win32.UberKeylogger.b skipped
C:\WINNT\Driver Cache\i386\driver.cab CAB: infected - 1 skipped
C:\WINNT\Etlukfjbfkh.qtt\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Etlukfjbfkh.qtt\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Etlukfjbfkh.qtt\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Etlukfjbfkh.qtt\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Gkwaiowfy.smd\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Gkwaiowfy.smd\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Gkwaiowfy.smd\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Gkwaiowfy.smd\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Hfzdssaxhj.pcb\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Hqqjyjpbsk.tle\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hqqjyjpbsk.tle\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hqqjyjpbsk.tle\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hqqjyjpbsk.tle\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Hsgdkznznfj.nwq\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hsgdkznznfj.nwq\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hsgdkznznfj.nwq\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hsgdkznznfj.nwq\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Htzucaj.fbv\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Hysbbzcg.dob\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hysbbzcg.dob\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hysbbzcg.dob\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hysbbzcg.dob\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ibzksuon.rqs\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Inalnomtp.lsr\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Ionmfzqsiyz.sjj\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ionmfzqsiyz.sjj\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ionmfzqsiyz.sjj\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ionmfzqsiyz.sjj\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Jxexazcn.ckd\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Jxexazcn.ckd\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Jxexazcn.ckd\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Jxexazcn.ckd\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Kucyxjddt.ypd\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Kwngnwnalh.pgk\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Kwngnwnalh.pgk\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Kwngnwnalh.pgk\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Kwngnwnalh.pgk\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Lazzjcsavv.upq\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Lazzjcsavv.upq\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Lazzjcsavv.upq\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Lazzjcsavv.upq\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Livrkzfwq.sfi\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Livrkzfwq.sfi\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Livrkzfwq.sfi\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Livrkzfwq.sfi\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Moimlpgltq.jmg\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Moimlpgltq.jmg\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Moimlpgltq.jmg\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Moimlpgltq.jmg\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ojuwbirjvsw.ftl\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ojuwbirjvsw.ftl\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ojuwbirjvsw.ftl\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ojuwbirjvsw.ftl\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ontnsay.tjl\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Otjyvhcso.asm\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Otjyvhcso.asm\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Otjyvhcso.asm\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Otjyvhcso.asm\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Przjrkql.yxv\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Qmqmrblddx.ral\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Qsxyojyks.fup\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Qsxyojyks.fup\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Qsxyojyks.fup\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Qsxyojyks.fup\sah.exe NSIS: infected - 3 skipped
C:\WINNT\rk.exe Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skipped
C:\WINNT\robvdilyisf.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.bd skipped
C:\WINNT\sahagent-fellymedia1002.exe/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\sahagent-fellymedia1002.exe NSIS: infected - 1 skipped
C:\WINNT\Shnxophp.hly\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\sjhjlbdm.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\spsyllwh.exe Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\Sqqubgxuh.ysc\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Sqqubgxuh.ysc\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Sqqubgxuh.ysc\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Sqqubgxuh.ysc\sah.exe NSIS: infected - 3 skipped
C:\WINNT\svcproc.exe Infected: Trojan.Win32.Stervis.c skipped
C:\WINNT\system32\exdl.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.j skipped
C:\WINNT\system32\exul.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.n skipped
C:\WINNT\system32\install2.exe Infected: Trojan.Win32.SecondThought.l skipped
C:\WINNT\system32\pup.exe/WISE0005.BIN Infected: Trojan.Win32.Revop.c skipped
C:\WINNT\system32\pup.exe WiseSFX: infected - 1 skipped
C:\WINNT\system32\silent.exe/data0002 Infected: not-a-virus:AdWare.Win32.WinFetcher.b skipped
C:\WINNT\system32\silent.exe/data0003/data0002 Infected: not-a-virus:AdWare.Win32.WinFetcher.b skipped
C:\WINNT\system32\silent.exe/data0003 Infected: not-a-virus:AdWare.Win32.WinFetcher.b skipped
C:\WINNT\system32\silent.exe NSIS: infected - 3 skipped
C:\WINNT\Tdpnusrktjw.vfb\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Temp\bs5598.tmpbsx32\cg.exe/data0002 Infected: Trojan-Downloader.Win32.Agent.i skipped
C:\WINNT\Temp\bs5598.tmpbsx32\cg.exe NSIS: infected - 1 skipped
C:\WINNT\Temp\pq_debug.tmp Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\Tsrdltseaam.ata\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Tugykcdljil.bvj\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Tugykcdljil.bvj\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Tugykcdljil.bvj\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Tugykcdljil.bvj\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ufjcxmwrfh.taz\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ufjcxmwrfh.taz\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ufjcxmwrfh.taz\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ufjcxmwrfh.taz\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Umgkulki.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.g skipped
C:\WINNT\Utzoylica.bmg\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Utzoylica.bmg\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Utzoylica.bmg\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Utzoylica.bmg\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Vbxukykbguk.tlu\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Vnvoqbro.riz\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Wxsstnmqk.opw\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Wzbvyed.yts\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Wzbvyed.yts\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Wzbvyed.yts\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Wzbvyed.yts\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Xlaxvvqxznd.yjx\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Xlaxvvqxznd.yjx\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Xlaxvvqxznd.yjx\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Xlaxvvqxznd.yjx\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ymhfhdyfph.xzx\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ymhfhdyfph.xzx\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ymhfhdyfph.xzx\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ymhfhdyfph.xzx\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Zbxrbfi.qnf\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped

Scan process completed.

[Smoke_O]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:48 AM, on 6/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\PROGRA~1\ASEMBL~1\tracert.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt205.tmp
C:\WINDOWS\system32\??pPatch\??ool32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {8A3CEF4B-778F-0F5E-AC3C-78A291EF4394} - C:\WINDOWS\system32\mrxl.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lphcefhj0er0g] C:\WINDOWS\system32\lphcefhj0er0g.exe
O4 - HKLM\..\Run: [SMrhcafhj0er0g] C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O21 - SSODL: Rcagps - {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9838 bytes

[pskelley]

This computer is in pretty bad shape, how did you allow it to get like this? You must keep it offline until we get it clean or we are wasting our time, the junk will continue to download more. You should be online only long enough to get and follow my directions. Print them so you can get back offline, we will start with combofix, these directions must be followed exactly.

Remove any old copies of combofix before you proceed.

Thanks to sUBs and anyone else who helped with this fix.

It is important that it is saved directly to your Desktop

Download ComboFix from Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Post the combofix log and a new HJT log.

Tutorial
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Thanks

[Smoke_O]

Yes I know this computer is in bad shape. Its my mother's and she doesnt maintain it. It doesnt have any anti-virus protection so its just a mess right now. Here are the logs


ComboFix 08-06-20.4 - Owner 2008-06-28 12:28:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.648 [GMT -4:00]
Running from: C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\23100247.exe
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\CPV.stt
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\s
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\RACLE~1
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temporary Internet Files\bestwiner.stt
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temporary Internet Files\CPV.stt
C:\Program Files\asembl~1
C:\Program Files\asembl~1\a?sembly\
C:\Program Files\asembl~1\tracert.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\racle~1
C:\WINDOWS\system32\1xhFPd.syz
C:\WINDOWS\system32\9.tmp
C:\WINDOWS\system32\DGPSZv.syz
C:\WINDOWS\system32\hljwugsf.bin
C:\WINDOWS\system32\mrxl.dll
C:\WINDOWS\system32\ppatch~1
C:\WINDOWS\system32\ppatch~1\??ool32.exe
C:\WINDOWS\system32\sstem~1
C:\WINDOWS\system32\sysrest.sys
C:\WINDOWS\system32\sysrest32.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLBDRIVER
-------\Legacy_CMDSERVICE
-------\Legacy_NETWORK_MONITOR
-------\Legacy_SYSREST.SYS
-------\Service_clbdriver
-------\Service_sysrest.sys


((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-28 )))))))))))))))))))))))))))))))
.

2008-06-26 18:41 . 2008-06-26 18:41 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer
2008-06-26 18:38 . 2008-06-26 18:41 <DIR> d-------- C:\Program Files\AXPFixer
2008-06-24 12:17 . 2008-06-24 12:17 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g
2008-06-24 12:17 . 2008-06-28 12:50 94,208 --a------ C:\WINDOWS\system32\pphcefhj0er0g.exe
2008-06-23 23:56 . 2008-06-24 12:17 <DIR> d-------- C:\Program Files\rhcafhj0er0g
2008-06-23 23:54 . 2008-06-28 12:50 90,838 --a------ C:\WINDOWS\system32\phcefhj0er0g.bmp
2008-06-23 23:54 . 2008-06-28 12:50 60,928 --a------ C:\WINDOWS\system32\blphcefhj0er0g.scr
2008-06-23 23:53 . 2008-06-23 23:53 109,056 --a------ C:\WINDOWS\system32\lphcefhj0er0g.exe
2008-06-17 03:53 . 2008-06-21 15:28 <DIR> d--hs---- C:\WINDOWS\T2x1aWdibw
2008-06-16 14:20 . 2008-06-16 14:20 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-16 14:20 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 14:19 . 2008-06-16 14:19 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-16 14:19 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-16 00:29 . 2008-06-16 00:29 4,286 --a------ C:\WINDOWS\system32\Jamster.ico
2008-06-15 02:51 . 2008-06-15 02:51 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\Viewpoint
2008-06-15 02:50 . 2008-06-15 02:50 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\AOL
2008-06-15 02:49 . 2008-06-15 02:49 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2
2008-06-15 02:15 . 2008-06-15 02:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-06-15 01:20 . 2008-06-15 01:20 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-06-15 01:06 . 2002-09-03 09:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-15 01:05 . 2008-06-15 01:05 <DIR> d-------- C:\Program Files\uTorrent
2008-06-15 01:05 . 2008-06-21 15:30 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\uTorrent
2008-06-10 16:45 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-27 04:39 316 ----a-w C:\drmHeader.bin
2008-06-27 02:26 --------- d-----w C:\Program Files\DivX
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-23 15:16 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-22 22:22 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-05-22 22:22 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-05-22 22:22 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-05-22 07:29 --------- d-----w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Apple Computer
2008-05-15 20:08 --------- d-----w C:\Program Files\iTunes
2008-05-15 20:07 --------- d-----w C:\Program Files\iPod
2008-05-15 20:06 --------- d-----w C:\Program Files\Bonjour
2008-05-15 20:05 --------- d-----w C:\Program Files\QuickTime
2008-05-15 20:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-05-15 20:03 --------- d-----w C:\Program Files\Apple Software Update
2008-05-15 20:02 --------- d-----w C:\Program Files\Common Files\Apple
2008-05-15 20:02 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-05-14 04:29 --------- d-----w C:\Program Files\Movie Joiner
2008-05-13 21:01 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Motive
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2006-08-11 00:47 17,528 ----a-w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\GDIPFONTCACHEV1.DAT
2003-11-15 20:22 58,264 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2005-07-29 20:24 472 --sha-r C:\WINDOWS\T2x1aWdibw\nZUYuqx2vT.vbs
.

------- Sigcheck -------

2002-09-03 09:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 03:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
2008-06-26 05:36 16896 35de7705f9fb23992740523b5c9fdac5 C:\WINDOWS\system32\svchost.exe

2002-09-03 09:00 516608 2246d8d8f4714a2cedb21ab9b1849abb C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 03:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2004-08-04 03:56 505856 481addbb21037489eacfcb308b1be2b0 C:\WINDOWS\system32\winlogon.exe

md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2002-09-03 09:00 1004032 a82b28bfc2e4455fe43022a498c0ef0a C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2002-09-03 09:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-04 03:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe
2004-08-04 03:56 110080 77f48ea251a503aae5fc0e7af4a425d7 C:\WINDOWS\system32\services.exe

2002-09-03 09:00 11776 b2b6ba905d0e3f8a32a0eb3b4051807b C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-04 03:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
2004-08-04 03:56 14336 d1320ba74a3866c2859b0518080cf84c C:\WINDOWS\system32\lsass.exe
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 50,736 2006-09-26 00:52:48 C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe
----a-w 48,280 2006-03-10 22:22:57 C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe

----a-w 153,168 2006-11-20 20:42:15 C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe

----a-r 71,216 2006-10-23 12:50:37 C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe

----a-w 49,263 2006-11-09 20:07:30 C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe

----a-w 460,336 2005-10-19 17:13:08 C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe

----a-w 116,272 2005-08-18 21:57:50 C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe

----a-w 992,808 2006-03-07 20:05:20 C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe

----a-w 110,592 2002-08-02 18:41:08 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe

----a-w 98,304 2006-08-28 23:16:07 C:\Program Files\QuickTime\bak\qttask.exe
----a-w 413,696 2008-03-29 03:37:20 C:\Program Files\QuickTime\QTTask.exe

----a-w 26,112 2006-06-21 08:29:38 C:\Program Files\Real\RealPlayer\bak\RealPlay.exe
----a-w 26,112 2007-08-29 23:02:17 C:\Program Files\Real\RealPlayer\realplay.exe

----a-w 114,688 2006-06-20 03:18:53 C:\WINDOWS\system32\bak\hkcmd.exe

----a-w 155,648 2006-06-20 03:19:05 C:\WINDOWS\system32\bak\igfxtray.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ltho"="C:\PROGRA~1\ASEMBL~1\tracert.exe" [ ]
"Jzjirr"="C:\WINDOWS\system32\??pPatch\??ool32.exe" [ ]
"AOL Fast Start"="C:\Program Files\America Online 9.0e\AOL.EXE" [2005-07-12 06:17 50776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"HostManager"="C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe" [2006-03-10 18:22 48280]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [ ]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [ ]
"AOLSPScheduler"="C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe" [2006-11-20 16:42 8784]
"sscRun"="C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe" [ ]
"OASClnt"="C:\Program Files\mcafee.com\antivirus\oasclnt.exe" [ ]
"EmailScan"="C:\Program Files\mcafee.com\antivirus\mcvsescn.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [ ]
"MPFExe"="C:\Program Files\mcafee.com\personal firewall\MPfTray.exe" [ ]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 17:42 79448]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-08-29 19:02 26112]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 19:52 936960]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 15:20 2061816]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"lphcefhj0er0g"="C:\WINDOWS\system32\lphcefhj0er0g.exe" [2008-06-23 23:53 109056]
"SMrhcafhj0er0g"="C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe" [2008-06-21 14:22 1642496]
"sysrest32.exe"="C:\WINDOWS\system32\sysrest32.exe" [ ]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ZyXEL G-220 v2 Wireless Adapter Utility.lnk - C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe [2007-09-17 16:11:27 10891264]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)
"NoDispScrSavPage"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Rcagps"= {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll [2007-04-16 11:52 32768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgm.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgs.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
--a------ 2002-10-03 20:50 684032 C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
--------- 2001-01-03 15:50 66048 C:\WINDOWS\system32\SK9910DM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PROMon.exe]
--a------ 2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2007-08-29 19:02 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0e\\waol.exe"=
"C:\\Program Files\\ZyXEL\\ZyXEL G-220 v2 Wireless Adapter Utility\\ZyXEL G-220 v2.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R2 RioPNP;RioPNP;C:\WINDOWS\system32\drivers\RioPNP.sys [2000-06-06 10:29]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;C:\WINDOWS\System32\ZDCNDIS5.sys [2006-08-17 10:03]
R3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanGZXP.sys [2006-08-17 10:03]
S1 seppgm;TCP x IP2 Kernel;C:\WINDOWS\System32\seppgm.sys []
S2 seppgs;TCP x IP2 Kernel32;C:\WINDOWS\System32\seppgm.sys []
S3 {BEE686B9-4C84-4487-9D72-9F40F051E973};{BEE686B9-4C84-4487-9D72-9F40F051E973};C:\WINDOWS\System32\svchost.exe [2008-06-26 05:36]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
{BEE686B9-4C84-4487-9D72-9F40F051E973}

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-28 12:51:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{BEE686B9-4C84-4487-9D72-9F40F051E973}]
"ServiceDll"="C:\DOCUME~1\OWNER~1.OLU\LOCALS~1\Temp\25E.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\McShield.exe
C:\Program Files\mcafee.com\personal firewall\MpfService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\America Online 9.0e\shellmon.exe
.
**************************************************************************
.
Completion time: 2008-06-28 13:10:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-28 17:10:18

Pre-Run: 8,581,869,568 bytes free
Post-Run: 11,257,212,928 bytes free

257 --- E O F --- 2008-06-20 06:54:47

[Smoke_O]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:43 PM, on 6/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lphcefhj0er0g] C:\WINDOWS\system32\lphcefhj0er0g.exe
O4 - HKLM\..\Run: [SMrhcafhj0er0g] C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O21 - SSODL: Rcagps - {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9288 bytes

[Smoke_O]

I just saw that I didnt download the recovery console. I am doing it now

[pskelley]

She has an AWF infection also, let's hope combofix will remove it for us?

I see McAfee Antivirus and Personal Firewall, are they not up to date and running?

Follow the directions carefully and in the numbered order.

1) C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove programs.
http://www.greatis.com/appdata/u/v/viewmgr.exe.htm
http://www.spywareinfo.com/newsletter/archives/2005/nov4.php#viewpoint
http://www.clickz.com/news/article.php/3561546

2) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm. Click OK.
You may reverse this for safety when we are finished.

3) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

(follow the CFScript instructions carefully!)

4) Open notepad and copy/paste the text in the codebox below into it:


AWF
C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe
C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe
C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe
C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe
C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe
C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe
C:\Program Files\QuickTime\bak\qttask.exe
C:\Program Files\Real\RealPlayer\bak\RealPlay.exe
C:\WINDOWS\system32\bak\hkcmd.exe
C:\WINDOWS\system32\bak\igfxtray.exe

File::
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\WINDOWS\system32\fyudix.dll
C:\WINDOWS\system32\sysrest32.exe

Folder::
C:\Program Files\rhcafhj0er0g

Save this as CFScript

http://i24.photobucket.com/albums/c30/ken545/CFScript.gif

Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)

5) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
(next toolbar is damaged, download it again once we finish if you use it)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O4 - HKLM\..\Run: [lphcefhj0er0g] C:\WINDOWS\system32\lphcefhj0er0g.exe
O4 - HKLM\..\Run: [SMrhcafhj0er0g] C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O21 - SSODL: Rcagps - {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll

Close all programs but HJT and all browser windows, then click on "Fix Checked"

6) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.


Restart and post the combofix log from CFScript, a new HJT log and any information I requested.
Add any comments you think will help.

Thanks

[Smoke_O]

Hopefully the scan took some of the junk off the computer. The program file C:\Program Files\rhcafhj0er0g is still there. But I think some of its components were deleted. Well here are the logs.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:51:39 PM, on 6/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 8148 bytes

[Smoke_O]

ComboFix 08-06-20.4 - Owner 2008-06-29 11:19:31.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.652 [GMT -4:00]
Running from: C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Desktop\CFScript.txt
* Resident AV is active


FILE ::
C:\WINDOWS\system32\fyudix.dll
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\WINDOWS\system32\sysrest32.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\rhcafhj0er0g
C:\Program Files\rhcafhj0er0g\database.dat
C:\Program Files\rhcafhj0er0g\license.txt
C:\Program Files\rhcafhj0er0g\MFC71.dll
C:\Program Files\rhcafhj0er0g\MFC71ENU.DLL
C:\Program Files\rhcafhj0er0g\msvcp71.dll
C:\Program Files\rhcafhj0er0g\msvcr71.dll
C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe.local
C:\Program Files\rhcafhj0er0g\rhcafhj0er0gSkin.dll
C:\Program Files\rhcafhj0er0g\Uninstall.exe
C:\WINDOWS\system32\fyudix.dll
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\WINDOWS\system32\sysrest.sys
C:\WINDOWS\system32\sysrest32.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SYSREST.SYS
-------\Service_sysrest.sys


((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-29 )))))))))))))))))))))))))))))))
.

2008-06-26 18:41 . 2008-06-26 18:41 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer
2008-06-26 18:38 . 2008-06-26 18:41 <DIR> d-------- C:\Program Files\AXPFixer
2008-06-24 12:17 . 2008-06-24 12:17 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g
2008-06-23 23:54 . 2008-06-29 10:52 90,838 --a------ C:\WINDOWS\system32\phcefhj0er0g.bmp
2008-06-23 23:54 . 2008-06-29 10:53 60,928 --a------ C:\WINDOWS\system32\blphcefhj0er0g.scr
2008-06-17 03:53 . 2008-06-21 15:28 <DIR> d--hs---- C:\WINDOWS\T2x1aWdibw
2008-06-16 14:20 . 2008-06-16 14:20 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-16 14:20 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 14:19 . 2008-06-16 14:19 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-16 14:19 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-16 00:29 . 2008-06-16 00:29 4,286 --a------ C:\WINDOWS\system32\Jamster.ico
2008-06-15 02:51 . 2008-06-15 02:51 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\Viewpoint
2008-06-15 02:50 . 2008-06-15 02:50 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\AOL
2008-06-15 02:49 . 2008-06-15 02:49 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2
2008-06-15 02:15 . 2008-06-15 02:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-06-15 01:20 . 2008-06-15 01:20 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-06-15 01:06 . 2002-09-03 09:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-15 01:05 . 2008-06-15 01:05 <DIR> d-------- C:\Program Files\uTorrent
2008-06-15 01:05 . 2008-06-21 15:30 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\uTorrent
2008-06-10 16:45 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-29 15:12 --------- d-----w C:\Program Files\Viewpoint
2008-06-29 15:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
2008-06-27 04:39 316 ----a-w C:\drmHeader.bin
2008-06-27 02:26 --------- d-----w C:\Program Files\DivX
2008-06-26 09:36 16,896 ----a-w C:\WINDOWS\system32\svchost.exe
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-05-23 15:16 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-22 22:22 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-05-22 22:22 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-05-22 22:22 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-05-22 22:22 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-05-22 22:22 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-05-22 22:22 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-05-22 22:22 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-05-22 22:22 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-22 07:29 --------- d-----w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Apple Computer
2008-05-15 20:08 --------- d-----w C:\Program Files\iTunes
2008-05-15 20:07 --------- d-----w C:\Program Files\iPod
2008-05-15 20:06 --------- d-----w C:\Program Files\Bonjour
2008-05-15 20:05 --------- d-----w C:\Program Files\QuickTime
2008-05-15 20:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-05-15 20:03 --------- d-----w C:\Program Files\Apple Software Update
2008-05-15 20:02 --------- d-----w C:\Program Files\Common Files\Apple
2008-05-15 20:02 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-05-14 04:29 --------- d-----w C:\Program Files\Movie Joiner
2008-05-13 21:01 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Motive
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2006-08-11 00:47 17,528 ----a-w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\GDIPFONTCACHEV1.DAT
2003-11-15 20:22 58,264 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2005-07-29 20:24 472 --sha-r C:\WINDOWS\T2x1aWdibw\nZUYuqx2vT.vbs
.

------- Sigcheck -------

2002-09-03 09:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 03:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
2008-06-26 05:36 16896 35de7705f9fb23992740523b5c9fdac5 C:\WINDOWS\system32\svchost.exe

2002-09-03 09:00 516608 2246d8d8f4714a2cedb21ab9b1849abb C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 03:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2004-08-04 03:56 505856 481addbb21037489eacfcb308b1be2b0 C:\WINDOWS\system32\winlogon.exe

2007-06-13 06:23 1035264 666c5d9dbced0cdfd48285103f8e2808 C:\WINDOWS\explorer.exe
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2002-09-03 09:00 1004032 a82b28bfc2e4455fe43022a498c0ef0a C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2002-09-03 09:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-04 03:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe
2004-08-04 03:56 110080 77f48ea251a503aae5fc0e7af4a425d7 C:\WINDOWS\system32\services.exe

2002-09-03 09:00 11776 b2b6ba905d0e3f8a32a0eb3b4051807b C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-04 03:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
2004-08-04 03:56 14336 d1320ba74a3866c2859b0518080cf84c C:\WINDOWS\system32\lsass.exe
.
((((((((((((((((((((((((((((( snapshot@2008-06-28_13.07.31.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-28 16:49:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-29 15:25:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 50,736 2006-09-26 00:52:48 C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe
----a-w 48,280 2006-03-10 22:22:57 C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe

----a-w 153,168 2006-11-20 20:42:15 C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe

----a-r 71,216 2006-10-23 12:50:37 C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe

----a-w 49,263 2006-11-09 20:07:30 C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe

----a-w 460,336 2005-10-19 17:13:08 C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe

----a-w 116,272 2005-08-18 21:57:50 C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe

----a-w 992,808 2006-03-07 20:05:20 C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe

----a-w 110,592 2002-08-02 18:41:08 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe

----a-w 98,304 2006-08-28 23:16:07 C:\Program Files\QuickTime\bak\qttask.exe
----a-w 413,696 2008-03-29 03:37:20 C:\Program Files\QuickTime\QTTask.exe

----a-w 26,112 2006-06-21 08:29:38 C:\Program Files\Real\RealPlayer\bak\RealPlay.exe
----a-w 26,112 2007-08-29 23:02:17 C:\Program Files\Real\RealPlayer\realplay.exe

----a-w 114,688 2006-06-20 03:18:53 C:\WINDOWS\system32\bak\hkcmd.exe

----a-w 155,648 2006-06-20 03:19:05 C:\WINDOWS\system32\bak\igfxtray.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ltho"="C:\PROGRA~1\ASEMBL~1\tracert.exe" [ ]
"Jzjirr"="C:\WINDOWS\system32\??pPatch\??ool32.exe" [ ]
"AOL Fast Start"="C:\Program Files\America Online 9.0e\AOL.EXE" [2005-07-12 06:17 50776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"HostManager"="C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe" [2006-03-10 18:22 48280]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [ ]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [ ]
"AOLSPScheduler"="C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe" [2006-11-20 16:42 8784]
"sscRun"="C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe" [ ]
"OASClnt"="C:\Program Files\mcafee.com\antivirus\oasclnt.exe" [ ]
"EmailScan"="C:\Program Files\mcafee.com\antivirus\mcvsescn.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [ ]
"MPFExe"="C:\Program Files\mcafee.com\personal firewall\MPfTray.exe" [ ]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 17:42 79448]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-08-29 19:02 26112]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 19:52 936960]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 15:20 2061816]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"lphcefhj0er0g"="C:\WINDOWS\system32\lphcefhj0er0g.exe" [ ]
"SMrhcafhj0er0g"="C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe" [ ]
"sysrest32.exe"="C:\WINDOWS\system32\sysrest32.exe" [ ]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ZyXEL G-220 v2 Wireless Adapter Utility.lnk - C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe [2007-09-17 16:11:27 10891264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Rcagps"= {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll [ ]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgm.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgs.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
--a------ 2002-10-03 20:50 684032 C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
--------- 2001-01-03 15:50 66048 C:\WINDOWS\system32\SK9910DM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PROMon.exe]
--a------ 2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2007-08-29 19:02 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0e\\waol.exe"=
"C:\\Program Files\\ZyXEL\\ZyXEL G-220 v2 Wireless Adapter Utility\\ZyXEL G-220 v2.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R2 RioPNP;RioPNP;C:\WINDOWS\system32\drivers\RioPNP.sys [2000-06-06 10:29]
R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;C:\WINDOWS\System32\ZDCNDIS5.sys [2006-08-17 10:03]
R3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanGZXP.sys [2006-08-17 10:03]
S1 seppgm;TCP x IP2 Kernel;C:\WINDOWS\System32\seppgm.sys []
S2 seppgs;TCP x IP2 Kernel32;C:\WINDOWS\System32\seppgm.sys []
S3 {BEE686B9-4C84-4487-9D72-9F40F051E973};{BEE686B9-4C84-4487-9D72-9F40F051E973};C:\WINDOWS\System32\svchost.exe [2008-06-26 05:36]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
{BEE686B9-4C84-4487-9D72-9F40F051E973}

*Newly Created Service* - NMSCFG
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-29 11:26:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{BEE686B9-4C84-4487-9D72-9F40F051E973}]
"ServiceDll"="C:\DOCUME~1\OWNER~1.OLU\LOCALS~1\Temp\25E.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\McShield.exe
C:\Program Files\mcafee.com\personal firewall\MpfService.exe
C:\WINDOWS\system32\NMSSvc.Exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\America Online 9.0e\shellmon.exe
.
**************************************************************************
.
Completion time: 2008-06-29 11:44:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-29 15:43:30
ComboFix2.txt 2008-06-28 19:33:29
ComboFix3.txt 2008-06-28 17:10:41

Pre-Run: 11,121,094,656 bytes free
Post-Run: 11,213,611,008 bytes free

268 --- E O F --- 2008-06-20 06:54:47

[pskelley]

Combofix/CFScript did not remove the AWF infection, we will have to do it manually, the option is to reformat.
http://spyware-free.us/tutorials/reformat/
http://www.cyberwalker.net/faqs/how-tos/reinstall-faq.html
http://helpdesk.its.uiowa.edu/windows/instructions/reformat.htm

Here is the first step:

You have a downloader trojan called Downloader.Agent.awf or Downloader.Agent.ayy. This trojan replaces legitimate files that are common on most computers with an infected file. It then moves the legitimate file to a "bak" or backup folder. Please follow the directions below to run FindAWF so we can identify the files that have been infected and the backups then restore them.
Please download FindAWF (http://noahdfear.geekstogo.com/FindAWF.exe) and save it to your Desktop

* Double-click FindAWF.exe to start the tool.
* Select option #1 - Scan for bak folders by typing 1 and press 'Enter'
* When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.

**Do not run any other option unless directed to do so.**

[Smoke_O]

Find AWF report by noahdfear ©2006
Version 1.40

The current date is: Tue 07/01/2008
The current time is: 13:59:40.81


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\QUICKT~1\BAK

08/28/2006 07:16 PM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

06/19/2006 11:18 PM 114,688 hkcmd.exe
06/19/2006 11:19 PM 155,648 igfxtray.exe
2 File(s) 270,336 bytes

Directory of C:\PROGRA~1\MCAFEE.COM\ANTIVI~1\BAK

10/19/2005 01:13 PM 460,336 mcvsescn.exe
08/18/2005 05:57 PM 116,272 oasclnt.exe
2 File(s) 576,608 bytes

Directory of C:\PROGRA~1\MCAFEE.COM\PERSON~1\BAK

03/07/2006 04:05 PM 992,808 MPfTray.exe
1 File(s) 992,808 bytes

Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK

08/02/2002 02:41 PM 110,592 mm_tray.exe
1 File(s) 110,592 bytes

Directory of C:\PROGRA~1\REAL\REALPL~1\BAK

06/21/2006 04:29 AM 26,112 RealPlay.exe
1 File(s) 26,112 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\ACS\BAK

10/23/2006 08:50 AM 71,216 AOLDial.exe
1 File(s) 71,216 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~1.0_1\BIN\BAK

11/09/2006 04:07 PM 49,263 jusched.exe
1 File(s) 49,263 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\BAK

09/25/2006 08:52 PM 50,736 AOLSoftware.exe
11/20/2006 04:42 PM 153,168 SSCRun.exe
2 File(s) 203,904 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\SERVICES\SAFETY~2\VER210~1\BAK

0 File(s) 0 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

413696 Mar 28 2008 "C:\Program Files\QuickTime\QTTask.exe"
98304 Aug 28 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
114688 Jul 10 2003 "C:\WINNT\system32\hkcmd.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\bak\hkcmd.exe"
114688 May 14 2002 "C:\WINNT\LastGood\System32\hkcmd.exe"
114688 Jun 19 2006 "C:\CABS\Winxp\Display\82845GGL\hkcmd.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\hkcmd.exe"
114688 May 14 2002 "C:\WINNT\system32\ReinstallBackups\0007\DriverFiles\hkcmd.exe"
155648 Jul 10 2003 "C:\WINNT\system32\igfxtray.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\bak\igfxtray.exe"
155648 May 14 2002 "C:\WINNT\LastGood\System32\igfxtray.exe"
155648 Jun 19 2006 "C:\CABS\Winxp\Display\82845GGL\igfxtray.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\igfxtray.exe"
155648 May 14 2002 "C:\WINNT\system32\ReinstallBackups\0007\DriverFiles\igfxtray.exe"
460336 Oct 19 2005 "C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe"
116272 Aug 18 2005 "C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe"
992808 Mar 7 2006 "C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe"
110592 Aug 2 2002 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe"
135168 Sep 3 2007 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\ChanDir\MMJB\mm_tray.exe"
26112 Aug 29 2007 "C:\Program Files\Real\RealPlayer\realplay.exe"
26112 Jun 21 2006 "C:\Program Files\Real\RealPlayer\bak\RealPlay.exe"
71216 Oct 23 2006 "C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe"
49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
49263 Nov 9 2006 "C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe"
48280 Mar 10 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe"
50736 Sep 25 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe"
153168 Nov 20 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe"


end of report

[pskelley]

Double-click FindAWF.exe to start the tool.

* Select option #2 - Restore files from bak folders by typing 2 and press 'Enter'
* A text file will open up. Please copy/paste the following bolded text into the text file:

C:\Program Files\QuickTime\bak\qttask.exe
C:\WINDOWS\system32\bak\hkcmd.exe
C:\WINDOWS\system32\bak\igfxtray.exe
C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe
C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe
C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe
C:\Program Files\Real\RealPlayer\bak\RealPlay.exe
C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe
C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe
C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe

* Close the .txt file and click 'Yes' to save the changes.
* When the tool has completed, a report will open up in notepad.

Please post the results of the awf.txt here.

[Smoke_O]

Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully

The current date is: Wed 07/02/2008
The current time is: 4:36:23.78


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\QUICKT~1\BAK

08/28/2006 07:16 PM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

06/19/2006 11:18 PM 114,688 hkcmd.exe
06/19/2006 11:19 PM 155,648 igfxtray.exe
2 File(s) 270,336 bytes

Directory of C:\PROGRA~1\MCAFEE.COM\ANTIVI~1\BAK

10/19/2005 01:13 PM 460,336 mcvsescn.exe
08/18/2005 05:57 PM 116,272 oasclnt.exe
2 File(s) 576,608 bytes

Directory of C:\PROGRA~1\MCAFEE.COM\PERSON~1\BAK

03/07/2006 04:05 PM 992,808 MPfTray.exe
1 File(s) 992,808 bytes

Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK

08/02/2002 02:41 PM 110,592 mm_tray.exe
1 File(s) 110,592 bytes

Directory of C:\PROGRA~1\REAL\REALPL~1\BAK

06/21/2006 04:29 AM 26,112 RealPlay.exe
1 File(s) 26,112 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\ACS\BAK

10/23/2006 08:50 AM 71,216 AOLDial.exe
1 File(s) 71,216 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~1.0_1\BIN\BAK

11/09/2006 04:07 PM 49,263 jusched.exe
1 File(s) 49,263 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\BAK

09/25/2006 08:52 PM 50,736 AOLSoftware.exe
11/20/2006 04:42 PM 153,168 SSCRun.exe
2 File(s) 203,904 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\SERVICES\SAFETY~2\VER210~1\BAK

0 File(s) 0 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

413696 Mar 28 2008 "C:\Program Files\QuickTime\QTTask.exe"
98304 Aug 28 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\hkcmd.exe"
114688 Jul 10 2003 "C:\WINNT\system32\hkcmd.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\bak\hkcmd.exe"
114688 May 14 2002 "C:\WINNT\LastGood\System32\hkcmd.exe"
114688 Jun 19 2006 "C:\CABS\Winxp\Display\82845GGL\hkcmd.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\hkcmd.exe"
114688 May 14 2002 "C:\WINNT\system32\ReinstallBackups\0007\DriverFiles\hkcmd.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\igfxtray.exe"
155648 Jul 10 2003 "C:\WINNT\system32\igfxtray.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\bak\igfxtray.exe"
155648 May 14 2002 "C:\WINNT\LastGood\System32\igfxtray.exe"
155648 Jun 19 2006 "C:\CABS\Winxp\Display\82845GGL\igfxtray.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\igfxtray.exe"
155648 May 14 2002 "C:\WINNT\system32\ReinstallBackups\0007\DriverFiles\igfxtray.exe"
460336 Oct 19 2005 "C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe"
116272 Aug 18 2005 "C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe"
992808 Mar 7 2006 "C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe"
110592 Aug 2 2002 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe"
135168 Sep 3 2007 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\ChanDir\MMJB\mm_tray.exe"
26112 Aug 29 2007 "C:\Program Files\Real\RealPlayer\realplay.exe"
26112 Jun 21 2006 "C:\Program Files\Real\RealPlayer\bak\RealPlay.exe"
71216 Oct 23 2006 "C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe"
49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
49263 Nov 9 2006 "C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe"
48280 Mar 10 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe"
50736 Sep 25 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe"
153168 Nov 20 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe"


end of report

[pskelley]

Double-click FindAWF.exe to start the tool.

* Select option #3 - Remove bak folders by typing 3 and press 'Enter'
* A text file will open up. Please copy/paste the following bolded text into the text file:

C:\Program Files\QuickTime\bak
C:\WINDOWS\system32\bak
C:\WINDOWS\system32\bak
C:\Program Files\mcafee.com\antivirus\bak
C:\Program Files\mcafee.com\antivirus\bak
C:\Program Files\mcafee.com\personal firewall\bak
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak
C:\Program Files\Real\RealPlayer\bak
C:\Program Files\Common Files\AOL\ACS\bak
C:\Program Files\Java\jre1.5.0_10\bin\bak
C:\Program Files\Common Files\AOL\1150817884\ee\bak
C:\Program Files\Common Files\AOL\1150817884\ee\bak

* Close the .txt file and click 'Yes' to save the changes.
* When the tool has completed, a report will open up in notepad.

Please post the results of the awf.txt in your next reply

[Smoke_O]

Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully

The current date is: Wed 07/02/2008
The current time is: 9:16:34.54


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\COMMON~1\AOL\ACS\BAK

10/23/2006 08:50 AM 71,216 AOLDial.exe
1 File(s) 71,216 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\SERVICES\SAFETY~2\VER210~1\BAK

0 File(s) 0 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

71216 Oct 23 2006 "C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe"


end of report

[pskelley]

Double-click FindAWF.exe to start the tool.

Select option #4 - Reset domain zones by typing 4 and press 'Enter'
You will receive a warning to reset domain zones
Press 1 then press Enter.
If you have manually included sites in the trusted zones, these will need to be re-inserted.


Restart the computer and scan for a new combofix log and post it along with a fresh HJT log.

Thanks

[Smoke_O]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:05:50 PM, on 7/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 8125 bytes

[Smoke_O]

ComboFix 08-07-05.1 - Owner 2008-07-07 12:34:29.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.714 [GMT -4:00]
Running from: C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\blphcefhj0er0g.scr
C:\WINDOWS\system32\phcefhj0er0g.bmp

.
((((((((((((((((((((((((( Files Created from 2008-06-07 to 2008-07-07 )))))))))))))))))))))))))))))))
.

2008-07-02 04:36 . 2006-06-19 23:19 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-07-02 04:36 . 2006-06-19 23:18 114,688 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-06-26 18:41 . 2008-06-26 18:41 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer
2008-06-26 18:38 . 2008-06-26 18:41 <DIR> d-------- C:\Program Files\AXPFixer
2008-06-24 12:17 . 2008-06-24 12:17 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g
2008-06-17 03:53 . 2008-06-21 15:28 <DIR> d--hs---- C:\WINDOWS\T2x1aWdibw
2008-06-16 14:20 . 2008-06-16 14:20 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-16 14:20 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 14:19 . 2008-06-16 14:19 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-16 14:19 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-16 00:29 . 2008-06-16 00:29 4,286 --a------ C:\WINDOWS\system32\Jamster.ico
2008-06-15 02:51 . 2008-06-15 02:51 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\Viewpoint
2008-06-15 02:50 . 2008-06-15 02:50 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\AOL
2008-06-15 02:49 . 2008-06-15 02:49 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2
2008-06-15 02:15 . 2008-06-15 02:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-06-15 01:20 . 2008-06-15 01:20 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-06-15 01:06 . 2002-09-03 09:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-15 01:05 . 2008-06-15 01:05 <DIR> d-------- C:\Program Files\uTorrent
2008-06-15 01:05 . 2008-06-21 15:30 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\uTorrent
2008-06-10 16:45 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-02 13:16 --------- d-----w C:\Program Files\QuickTime
2008-06-29 15:12 --------- d-----w C:\Program Files\Viewpoint
2008-06-29 15:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
2008-06-27 04:39 316 ----a-w C:\drmHeader.bin
2008-06-27 02:26 --------- d-----w C:\Program Files\DivX
2008-06-26 09:36 16,896 ----a-w C:\WINDOWS\system32\svchost.exe
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-05-23 15:16 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-22 22:22 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-05-22 22:22 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-05-22 22:22 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-05-22 22:22 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-05-22 22:22 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-05-22 22:22 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-05-22 22:22 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-05-22 22:22 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-22 07:29 --------- d-----w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Apple Computer
2008-05-15 20:08 --------- d-----w C:\Program Files\iTunes
2008-05-15 20:07 --------- d-----w C:\Program Files\iPod
2008-05-15 20:06 --------- d-----w C:\Program Files\Bonjour
2008-05-15 20:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-05-15 20:03 --------- d-----w C:\Program Files\Apple Software Update
2008-05-15 20:02 --------- d-----w C:\Program Files\Common Files\Apple
2008-05-15 20:02 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-05-14 04:29 --------- d-----w C:\Program Files\Movie Joiner
2008-05-13 21:01 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Motive
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2006-08-11 00:47 17,528 ----a-w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\GDIPFONTCACHEV1.DAT
2003-11-15 20:22 58,264 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2005-07-29 20:24 472 --sha-r C:\WINDOWS\T2x1aWdibw\nZUYuqx2vT.vbs
.

------- Sigcheck -------

2002-09-03 09:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 03:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
2008-06-26 05:36 16896 35de7705f9fb23992740523b5c9fdac5 C:\WINDOWS\system32\svchost.exe

2002-09-03 09:00 516608 2246d8d8f4714a2cedb21ab9b1849abb C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 03:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2004-08-04 03:56 505856 481addbb21037489eacfcb308b1be2b0 C:\WINDOWS\system32\winlogon.exe

2007-06-13 06:23 1035264 666c5d9dbced0cdfd48285103f8e2808 C:\WINDOWS\explorer.exe
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2002-09-03 09:00 1004032 a82b28bfc2e4455fe43022a498c0ef0a C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2002-09-03 09:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-04 03:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe
2004-08-04 03:56 110080 77f48ea251a503aae5fc0e7af4a425d7 C:\WINDOWS\system32\services.exe

2002-09-03 09:00 11776 b2b6ba905d0e3f8a32a0eb3b4051807b C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-04 03:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
2004-08-04 03:56 14336 d1320ba74a3866c2859b0518080cf84c C:\WINDOWS\system32\lsass.exe

2005-06-10 19:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\$hf_mig$\KB896423\SP2GDR\spoolsv.exe
2005-06-10 20:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-10 19:55 53248 6b4bf97957a0b8795811975d4bf1acfe C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
2004-08-04 03:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
2002-09-03 09:00 51200 9b4155ba58192d4073082b8fc5d42612 C:\WINDOWS\$NtUninstallKB896423_0$\spoolsv.exe
2004-08-04 03:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
2005-06-10 19:53 58368 e1f9dbda12cbef81cf3d771d45c7dea5 C:\WINDOWS\system32\spoolsv.exe
.
((((((((((((((((((((((((((((( snapshot@2008-06-28_13.07.31.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-28 16:49:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-07 03:08:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-r 71,216 2006-10-23 12:50:37 C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AOL Fast Start"="C:\Program Files\America Online 9.0e\AOL.EXE" [2005-07-12 06:17 50776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2006-06-19 23:19 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2006-06-19 23:18 114688]
"HostManager"="C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe" [2006-03-10 18:22 48280]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [N/A]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [N/A]
"AOLSPScheduler"="C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe" [2006-11-20 16:42 8784]
"sscRun"="C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe" [N/A]
"OASClnt"="C:\Program Files\mcafee.com\antivirus\oasclnt.exe" [N/A]
"EmailScan"="C:\Program Files\mcafee.com\antivirus\mcvsescn.exe" [N/A]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [N/A]
"MPFExe"="C:\Program Files\mcafee.com\personal firewall\MPfTray.exe" [N/A]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 17:42 79448]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-08-29 19:02 26112]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 19:52 936960]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 15:20 2061816]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ZyXEL G-220 v2 Wireless Adapter Utility.lnk - C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe [2007-09-17 16:11:27 10891264]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgm.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgs.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
--a------ 2002-10-03 20:50 684032 C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2007-08-29 19:02 26112 C:\Program Files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
--------- 2001-01-03 15:50 66048 C:\WINDOWS\system32\SK9910DM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PROMon.exe]
--a------ 2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0e\\waol.exe"=
"C:\\Program Files\\ZyXEL\\ZyXEL G-220 v2 Wireless Adapter Utility\\ZyXEL G-220 v2.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R2 RioPNP;RioPNP;C:\WINDOWS\system32\drivers\RioPNP.sys [2000-06-06 10:29]
R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;C:\WINDOWS\System32\ZDCNDIS5.sys [2006-08-17 10:03]
R3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanGZXP.sys [2006-08-17 10:03]
S1 seppgm;TCP x IP2 Kernel;C:\WINDOWS\System32\seppgm.sys []
S2 seppgs;TCP x IP2 Kernel32;C:\WINDOWS\System32\seppgm.sys []
S3 {BEE686B9-4C84-4487-9D72-9F40F051E973};{BEE686B9-4C84-4487-9D72-9F40F051E973};C:\WINDOWS\System32\svchost.exe [2008-06-26 05:36]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
{BEE686B9-4C84-4487-9D72-9F40F051E973}

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-07 12:40:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{BEE686B9-4C84-4487-9D72-9F40F051E973}]
"ServiceDll"="C:\DOCUME~1\OWNER~1.OLU\LOCALS~1\Temp\25E.tmp"
.
Completion time: 2008-07-07 12:44:56
ComboFix-quarantined-files.txt 2008-07-07 16:43:52
ComboFix2.txt 2008-06-29 15:44:39
ComboFix3.txt 2008-06-28 19:33:29
ComboFix4.txt 2008-06-28 17:10:41

Pre-Run: 9,850,032,128 bytes free
Post-Run: 10,020,999,168 bytes free

211 --- E O F --- 2008-06-20 06:54:47

[pskelley]

I am not sure why but one of the infected programs did not get cleaned.
(((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))

----a-r 71,216 2006-10-23 12:50:37 C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe


Let's try to fix this like this:

1) Double-click FindAWF.exe to start the tool.

* Select option #2 - Restore files from bak folders by typing 2 and press 'Enter'
* A text file will open up. Please copy/paste the following bolded text into the text file:

C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe

* Close the .txt file and click 'Yes' to save the changes.
* When the tool has completed, a report will open up in notepad.

Please post the results of the awf.txt here. <<< no need to post this


2) Double-click FindAWF.exe to start the tool.

* Select option #3 - Remove bak folders by typing 3 and press 'Enter'
* A text file will open up. Please copy/paste the following bolded text into the text file:

C:\Program Files\Common Files\AOL\ACS\bak

* Close the .txt file and click 'Yes' to save the changes.
* When the tool has completed, a report will open up in notepad.

Please post the results of the awf.txt in your next reply <<< no need to post this

3) Double-click FindAWF.exe to start the tool.

Select option #4 - Reset domain zones by typing 4 and press 'Enter'
You will receive a warning to reset domain zones
Press 1 then press Enter.
If you have manually included sites in the trusted zones, these will need to be re-inserted.

4) Let's check to make sure it is gone, restart the computer then:

* Double-click FindAWF.exe to start the tool.
* Select option #1 - Scan for bak folders by typing 1 and press 'Enter'
* When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.

Can you tell me how the computer is running.

Thanks

[Smoke_O]

The computer seems to be running fine but there is still tons of shortcuts of fake programs and my desktop is still blue and says that I am infected with malware. There is a program called AntiVirus 2008 that has shortcuts everywhere. It used to pop up and asked to be run but it doesnt occur anymore so its probably gone. But the shortcuts and the programs are still on the computer. Im sure I can just change it but Im not sure if it is from a virus or the computer put it up. 'My Computer' doesnt have an icon. I mean there is an icon but not of a folder if that makes any sense. Well here is the report



Find AWF report by noahdfear ©2006
Version 1.40

The current date is: Tue 07/01/2008
The current time is: 13:59:40.81


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\QUICKT~1\BAK

08/28/2006 07:16 PM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

06/19/2006 11:18 PM 114,688 hkcmd.exe
06/19/2006 11:19 PM 155,648 igfxtray.exe
2 File(s) 270,336 bytes

Directory of C:\PROGRA~1\MCAFEE.COM\ANTIVI~1\BAK

10/19/2005 01:13 PM 460,336 mcvsescn.exe
08/18/2005 05:57 PM 116,272 oasclnt.exe
2 File(s) 576,608 bytes

Directory of C:\PROGRA~1\MCAFEE.COM\PERSON~1\BAK

03/07/2006 04:05 PM 992,808 MPfTray.exe
1 File(s) 992,808 bytes

Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK

08/02/2002 02:41 PM 110,592 mm_tray.exe
1 File(s) 110,592 bytes

Directory of C:\PROGRA~1\REAL\REALPL~1\BAK

06/21/2006 04:29 AM 26,112 RealPlay.exe
1 File(s) 26,112 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\ACS\BAK

10/23/2006 08:50 AM 71,216 AOLDial.exe
1 File(s) 71,216 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~1.0_1\BIN\BAK

11/09/2006 04:07 PM 49,263 jusched.exe
1 File(s) 49,263 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\BAK

09/25/2006 08:52 PM 50,736 AOLSoftware.exe
11/20/2006 04:42 PM 153,168 SSCRun.exe
2 File(s) 203,904 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\SERVICES\SAFETY~2\VER210~1\BAK

0 File(s) 0 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

413696 Mar 28 2008 "C:\Program Files\QuickTime\QTTask.exe"
98304 Aug 28 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
114688 Jul 10 2003 "C:\WINNT\system32\hkcmd.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\bak\hkcmd.exe"
114688 May 14 2002 "C:\WINNT\LastGood\System32\hkcmd.exe"
114688 Jun 19 2006 "C:\CABS\Winxp\Display\82845GGL\hkcmd.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\hkcmd.exe"
114688 May 14 2002 "C:\WINNT\system32\ReinstallBackups\0007\DriverFiles\hkcmd.exe"
155648 Jul 10 2003 "C:\WINNT\system32\igfxtray.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\bak\igfxtray.exe"
155648 May 14 2002 "C:\WINNT\LastGood\System32\igfxtray.exe"
155648 Jun 19 2006 "C:\CABS\Winxp\Display\82845GGL\igfxtray.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\igfxtray.exe"
155648 May 14 2002 "C:\WINNT\system32\ReinstallBackups\0007\DriverFiles\igfxtray.exe"
460336 Oct 19 2005 "C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe"
116272 Aug 18 2005 "C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe"
992808 Mar 7 2006 "C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe"
110592 Aug 2 2002 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe"
135168 Sep 3 2007 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\ChanDir\MMJB\mm_tray.exe"
26112 Aug 29 2007 "C:\Program Files\Real\RealPlayer\realplay.exe"
26112 Jun 21 2006 "C:\Program Files\Real\RealPlayer\bak\RealPlay.exe"
71216 Oct 23 2006 "C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe"
49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
49263 Nov 9 2006 "C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe"
48280 Mar 10 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe"
50736 Sep 25 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe"
153168 Nov 20 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe"


end of report

Find AWF report by noahdfear ©2006


bak folders found


---------- DIR.TXT

[pskelley]

Thanks for the feedback, right in the middle of the cleanup combofix report the AWF that had to be removed first. Let's start with a new MBAM scan and a fresh HJT log. You have MBAM on board but make sure you update it.

Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post contents of that file & a new HJT log in your next reply.

Shortcuts on the Desktop may not have gotten removed with the programs. You may delete any shortcuts you know do not belong there.

Thanks

[Smoke_O]

Malwarebytes' Anti-Malware 1.20
Database version: 933
Windows 5.1.2600 Service Pack 2

1:57:28 PM 7/9/2008
mbam-log-7-9-2008 (13-57-28).txt

Scan type: Full Scan (C:\|)
Objects scanned: 136590
Time elapsed: 45 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 26
Files Infected: 56

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\GetModule (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\GetPack (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iCheck (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Advanced XP Fixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\BrowserObjects (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer\AXPFixer\Quarantine\Packages (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Antivirus XP 2008 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\AXPFixer\AXPFixer.exe (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\Uninstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\Outerinfo\FF\components\FF.dll.vir (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe.vir (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\rhcafhj0er0g\rhcafhj0er0gSkin.dll.vir (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\rhcafhj0er0g\Uninstall.exe.vir (Rogue.Installer) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\9.tmp.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\mrxl.dll.vir (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\pphcefhj0er0g.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP519\A0072795.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP519\A0072805.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP519\A0072814.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP519\A0073814.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP519\A0073851.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP519\A0073862.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP520\A0074852.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP520\A0074863.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP520\A0074935.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP521\A0074968.exe (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP521\A0074995.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP522\A0075030.dll (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP522\A0075031.exe (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP522\A0075034.dll (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP522\A0076095.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP522\A0076111.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP523\A0076226.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP523\A0076252.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP523\A0076270.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP524\A0076320.exe (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP524\A0076321.dll (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP524\A0076322.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP524\A0076326.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\AXPFixer.exe.local (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\AXPFixerSkin.dll (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\database.dat (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\license.txt (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\MFC71.dll (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\MFC71ENU.DLL (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\msvcp71.dll (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Program Files\AXPFixer\msvcr71.dll (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Advanced XP Fixer\Advanced XP Fixer.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Advanced XP Fixer\How to Register Advanced XP Fixer.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Advanced XP Fixer\License Agreement.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Advanced XP Fixer\Register Advanced XP Fixer.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Advanced XP Fixer\Uninstall.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Desktop\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Advanced XP Fixer.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\Internet Explorer\Quick Launch\AXPFixer.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Desktop\AXPFixer.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.

[Smoke_O]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:59:31 PM, on 7/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 8034 bytes

[pskelley]

MBAM got the rouge junk we were working on when AWF showed up in the combofix log, and your HJT log looks clean of malware. How is the computer running now. Where did you say you got your computer this badly infected?

Clean infected System Restore files like this:
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Reboot

Turn ON System Restore,
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

If all is well, let's remove combofix like this:

Click START then RUN
Now type or copy Combofix /u in the runbox and click OK.
Note the space between the X and the U, it needs to be there.

http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png

Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx

Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

http://www.malwarecomplaints.info/

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.