Help - Trojans?

[dogwalker]

Hi,
A recent Spybot scan found Virtumonde and apparently fixed it. Subsequent scans reported no infections but I noticed that each scan slowed considerably for some files eg virtumonde.prx, .sci, .dll(twice per scan), and .sdn. I also noticed a Zlob file. I could find none of these files with a search of my hard drive and concluded after reading info in S&D support and forums that my computer was probably still infected and may get worse if I continued with online use. Can you please advise?
All pre post action has been taken.
Thanks


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:28:45, on 24/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Tall Emu\Online Armor\oacat.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Tall Emu\Online Armor\oahlp.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\ieuser.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oacat.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9744 bytes

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance) http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

I apologize for the wait, volunteers are swamped at all forums with infected computers. If you have resolved your issues, please post to let me know so I can close this topic.

If you still need help, and you have read and followed the "Before you Post" directions, post a new HJT log since it has been five days, and I will take a look, please describe any recent symptoms.

I am not seeing anything obvious in the HJT log, but if you post a fresh HJT log, I will help you take a look for anything hidden.

Thanks

[dogwalker]

Hi,
Just to confirm, I have read and taken all the suggested action in the "Before you post" links.

System Restore is on.

Tea Timer is disabled.

Trying to run Erunt today resulted in error notice:-
"Unable to create file C:\Windows\ERDNT\29-01-2009\ERDNT.inf".
Uninstalled, rebooted and reinstalled, ERDNT OK.

No other recent symptoms to report, comments as per first post still apply ie Spybot scan shows that Virtumonde and Zlob files are present but hidden from normal searches.
I'm doing this for an elderly lady, who's new to computers, who reported things didn't seem to be working as well. I found these possible infections whilst carrying out routine updates and scans.
This machine has been off line until replying to you to reduce the risk of further invasion and spreading to others.

New HJT log follows, thanks for your help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:28:59, on 29/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Tall Emu\Online Armor\oacat.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Tall Emu\Online Armor\oahlp.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1232820802695&h=2a49cb3cd2e8cffe58f045ab0a1ea90d/&filename=jinstall-6u11-windows-i586-jc.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oacat.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9876 bytes

[pskelley]

Thanks for returning your information, proceed carefully like this to take a look.

1) Please DO NOT ENABLE Spybot S&D TeaTimer while we work together.

2) Download Malwarebytes' Anti-Malware to your Desktop
http://www.malwarebytes.org/

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post contents of that file & a new HJT log in your next reply.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Tutorial if needed:
http://www.techsupportteam.org/forum/tutorials/2282-malwarebytes-anti-malware-mbam.html

3) Post also an uninstall list: Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list..." Button.
Save it to your desktop. Copy and paste the contents into your reply.
Image: http://img.bleepingcomputer.com/tutorials/hijackthis/uninstall-man.jpg

Thanks

[dogwalker]

Hi again, from not so sunny UK.
Have done as you directed, Malawarebytes' log, HJT new log and uninstall list follow.

Malawarebyte's scan reported no infections found. Interestingly as far as I could tell it didn't scan any files of the Virtumonde or Zlob type, also the number of objects scanned was much less than SpyBot, approx 160k. However when I re-ran a SpyBot (teatimer not running) scan although it reported no infections found or fixed, out of 379836 objects scanned it spent about half the scan time reporting it was scanning these files:-

virtumonde.dll
virtumonde.generic
zlob.downloader
zlob.downloader.rid
a 2nd instance of virtumonde.dll from around 140k to 150k of objects scanned.
virtumonde.sci from around 150k to 200k.
virtumonde.sdn from around 200k to 330k.
a 2nd instance of zlob.downloader from around 332k to 334k
zlob.downloader.bs from around 334k to 337k.

There were other virtumonde and zlob files scanned but their scan time was so brief I could not get the details.

It looks like the total number of objects on this computer associated with virtumonde and zlob is approaching 200k.

The only fix Sbybot has reported was in the first scan on the Jan 19th 09 and is listed in the recovery section as Virtumonde - Executable - C:\Windows\snuvcdsm.exe (virtumonde.zip?). As I said before I can find none of these files with the usual hard drive searches including hidden files and folders and protected op system files.

Reports:-

Malwarebytes' Anti-Malware 1.33
Database version: 1712
Windows 6.0.6001 Service Pack 1

01/02/2009 14:41:35
mbam-log-2009-02-01 (14-41-35).txt

Scan type: Full Scan (C:\|)
Objects scanned: 159348
Time elapsed: 1 hour(s), 19 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:43:48, on 01/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Tall Emu\Online Armor\oahlp.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Tall Emu\Online Armor\oacat.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1232820802695&h=2a49cb3cd2e8cffe58f045ab0a1ea90d/&filename=jinstall-6u11-windows-i586-jc.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oacat.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10152 bytes


Hijackthis uninstall_list.txt:-
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 8.1.0
Adobe Shockwave Player
Atheros Driver Installation Program
AVG Free 8.0
CDDRV_Installer
Conexant HD Audio
CyberLink YouCam
DVD Suite
ERUNT 1.1j
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
HijackThis 2.0.2
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.6
HP Easy Setup - Frontend
HP Help and Support
HP Quick Launch Buttons 6.40 B2
HP Total Care Advisor
HP Update
HP User Guides 0092
HP Wireless Assistant
Intel(R) Graphics Media Accelerator Driver
Intel(R) Matrix Storage Manager
Intel(R) TV Wizard
Java(TM) 6 Update 11
KhalInstallWrapper
LabelPrint
Logitech SetPoint
Malwarebytes' Anti-Malware
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.5)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
muvee autoProducer 6.1
My HP Games
NetWaiting
Online Armor 3.0
Power2Go
PowerDirector
QuickPlay SlingPlayer 0.4.6
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
Realtek USB 2.0 Card Reader
Spybot - Search & Destroy
SpywareBlaster 4.1
Touch Pad Driver
Viewpoint Media Player
Windows Live OneCare safety scanner

[pskelley]

Let's chat a bit before I drag out more powerful tool. MBAM is one of the best at finding and removing just the junk you mention. Of course the items must be in the data base to see them.

Let's talk about Spybot 1.6, when it scans, the items you see across the botton of the scanner are items Spybot S&D is scanning for, not items it is finding. Only the final report where it shows you in the report as described in this tutorial: http://www.safer-networking.org/en/tutorial/index.html
Are items you must take action with.


Uninstall list: I look for malware and security issues and will not know all of your programs, but you should.
Hackers are using out of date programs to infect folks more and more,
Here is a small free tool that lets you know when something needs an update if you are interested:
http://secunia.com/vulnerability_scanning/personal/ While PSI runs in the System Tray for realtime notifications, I personally prefer to turn it off in MSConfig and run it from All Programs when I want to do a check.

Adobe Reader 8.1.0 <<< out of date and unsafe, see this:
http://news.cnet.com/8301-1009_3-10081618-83.html?tag=nl.e433
http://www.filehippo.com/download_adobe_reader/
(if you want a smaller program, look at this one)
Foxit Reader 2.3 for Windows (make sure to uncheck toolbars)
http://www.foxitsoftware.com/pdf/rd_intro.php

Viewpoint Media Player <<< suggested uninstall:
For your information, Viewpoint is installed by aol probably without your knowledge.
http://www.spywareinfo.com/newsletter/archives/2005/nov4.php#viewpoint
http://www.clickz.com/news/article.php/3561546
http://vil.nai.com/vil/content/v_137262.htm

Let me know if you have any other malware issues.

Thanks

[dogwalker]

Hi,
Your explanation is much appreciated, I'll look at the software changes/updates you mentioned. Am I correct in thinking that as far as you can tell the computer is at present clean?
Regards.

[pskelley]

Let's take a look at a AVG scan, follow these directions:

*Right click the icon for AVG in System Tray and choose Open AVG User Interface.

*Click on Update now, allow AVG to download and install any new updates.

* Click on Computer Scanner then choose "Scan whole computer", this takes a round one hour on the computer I am using now.

* Near the bottom above the words "The scan is complete" choose "Export overview to file"

* Choose Desktop and give it a name you will recognize like AVG Scan Results, then choose SAVE.

* Close results and close the Interface.

* Copy and paste the contents of that file unless it is clean, then just let me know and tell me how the computer is running.

Thanks

[dogwalker]

Hi from snowy UK,
Have completed actions as you suggested.
Adobe Reader updated.
Adobe flash player updated.
Viewpoint Media Player uninstalled.
PSI advanced scan now reports 100% score.

Updated AVG scan reports no infections found, copy of report follows,
Thanks for help.

AVG Scan:-
Scan "Scheduled scan" was finished.
No infection was found during this scan
Folders selected for scanning:;"Scan whole computer"
Scan started:;"04 February 2009, 12:00:02"
Scan finished:;"04 February 2009, 14:11:23 (2 hour(s) 11 minute(s) 21 second(s))"
Total object scanned:;"793301"
User who launched the scan:;"SYSTEM"

Information
File;"Infection";"Result"
C:\Documents and Settings\;"Locked file. Not tested.";"Locked file. Not tested."
C:\pagefile.sys;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Microsoft Office\OFFICE11\1033\EXPTOOWS.XLA;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\Library\Analysis\ATPVBAEN.XLA;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\Library\Analysis\FUNCRES.XLA;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\Library\Analysis\PROCDB.XLA;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\Library\EUROTOOL.XLA;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\Library\LOOKUP.XLA;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\Library\SOLVER\SOLVER.XLA;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\Library\SUMIF.XLA;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\MACROS\SUPPORT.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\OFFICE11\SAMPLES\SOLVSAMP.XLS;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Agenda Wizard.Wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Batch Conversion Wizard.Wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Brochure.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Calendar Wizard.Wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Contemporary Fax.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Contemporary Letter.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Contemporary Memo.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Contemporary Report.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Contemporary Resume.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\CONTMADR.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\CONTMFAX.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\CONTMLTR.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Directory.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Elegant Fax.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Elegant Letter.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Elegant Memo.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Elegant Report.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Elegant Resume.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\ELEGMADR.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\ELEGMFAX.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\ELEGMLTR.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Envelope Wizard.wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Fax Wizard.wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\LABEL.WIZ;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Letter Wizard.wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Manual.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Memo Wizard.wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\MERGELTR.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Pleading Wizard.wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\PLEADSUB.WIZ;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Professional Fax.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Professional Letter.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Professional Memo.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Professional Report.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Professional Resume.dot;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\PROFMADR.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\PROFMFAX.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\PROFMLTR.DOT;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Resume Wizard.wiz;"Contains macros";""
C:\Program Files\Microsoft Office\Templates\1033\Thesis.dot;"Contains macros";""
C:\Program Files\Tall Emu\Online Armor\firewall.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Tall Emu\Online Armor\fwdata.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Tall Emu\Online Armor\oacached.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Tall Emu\Online Armor\programs.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Tall Emu\Online Armor\reference.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Tall Emu\Online Armor\server.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Tall Emu\Online Armor\signs.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Tall Emu\Online Armor\sites.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Program Files\Tall Emu\Online Armor\taskman.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\ProgramData\Desktop\;"Locked file. Not tested.";"Locked file. Not tested."
C:\ProgramData\Documents\;"Locked file. Not tested.";"Locked file. Not tested."
C:\ProgramData\Favorites\;"Locked file. Not tested.";"Locked file. Not tested."
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log;"Locked file. Not tested.";"Locked file. Not tested."
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log;"Locked file. Not tested.";"Locked file. Not tested."
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb;"Locked file. Not tested.";"Locked file. Not tested."
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb;"Locked file. Not tested.";"Locked file. Not tested."
C:\ProgramData\Spybot - Search & Destroy\Recovery\Virtumonde.zip;"Password-protected";""
C:\ProgramData\Templates\;"Locked file. Not tested.";"Locked file. Not tested."
C:\SwSetup\Off12\US\HS07Office\Excel.en-us\ExcelLR.cab;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Excel.en-us\ExcelLR.cab:\ATPVBAEN.XLAM_1033;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Excel.en-us\ExcelLR.cab:\FUNCRES.XLAM_1033;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Excel.en-us\ExcelLR.cab:\LOOKUP.XLAM_1033;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Excel.en-us\ExcelLR.cab:\PROCDB.XLAM_1033;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Excel.en-us\ExcelLR.cab:\SOLVER.XLAM_1033;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Excel.en-us\ExcelLR.cab:\SOLVSAMP.XLS_1033;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Excel.en-us\ExcelLR.cab:\SUMIF.XLAM_1033;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\HomeStudentr.WW\HomeSrWW.cab;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\HomeStudentr.WW\HomeSrWW.cab:\HTML.XLAM;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Office.en-us\OfficeLR.cab;"Contains macros";""
C:\SwSetup\Off12\US\HS07Office\Office.en-us\OfficeLR.cab:\EXPTOOWS.XLA_1033;"Contains macros";""
C:\System Volume Information\{01b3796d-e182-11dd-a13f-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{07b6083f-da6c-11dd-99ce-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{09f61be0-efac-11dd-8400-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{09f61c2e-efac-11dd-8400-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{203595eb-ce9e-11dd-9277-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{36bf88d9-e945-11dd-9938-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{6e077fc7-e728-11dd-9201-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{6e077fe8-e728-11dd-9201-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{7f8fa9c8-ee3d-11dd-942d-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{7f8fa9ce-ee3d-11dd-942d-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{7fb32580-f2a4-11dd-bfd8-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{8928072f-ea28-11dd-be72-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{89280735-ea28-11dd-be72-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{8928073b-ea28-11dd-be72-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{9965a064-d75c-11dd-88d6-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{a28f0b13-f29f-11dd-80c0-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{ce20ddc8-e93d-11dd-a115-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{ce20ddd3-e93d-11dd-a115-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{e9750e3f-e60e-11dd-8e48-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\{e9750ed9-e60e-11dd-8e48-001eec75e6e8}{3808876b-c176-4e48-b7ae-04046e6cc752};"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\AppData\Local\History\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\AppData\Local\Temporary Internet Files\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\Cookies\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\Documents\My Music\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\Documents\My Pictures\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\Documents\My Videos\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\NetHood\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\PrintHood\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\Recent\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Default\Templates\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\AppData\Local\History\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\AppData\Local\Microsoft\Windows\UsrClass.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\AppData\Roaming\OnlineArmor\client.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\Documents\Backup of Pedigree.xlk;"Password-protected";""
C:\Users\Mill\Documents\Compcresh.xls;"Password-protected";""
C:\Users\Mill\Documents\My Music\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\Documents\My Pictures\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\Documents\My Videos\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\Documents\Pedigree.xls;"Password-protected";""
C:\Users\Mill\NetHood\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\ntuser.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\ntuser.dat.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\ntuser.dat.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\PrintHood\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Mill\Templates\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Public\Documents\My Music\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Public\Documents\My Pictures\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Users\Public\Documents\My Videos\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.7969\ATPVBAEN.XLA_1033;"Contains macros";""
C:\Windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.7969\EUROTOOL.XLA;"Contains macros";""
C:\Windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.7969\FUNCRES.XLA_1033;"Contains macros";""
C:\Windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.8173\SUMIF.XLA_1033;"Contains macros";""
C:\Windows\Installer\8ae1d77.msp;"Contains macros";""
C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\Installer\8ae1d77.msp:\PCW_CAB_H15000_1;"Contains macros";""
C:\Windows\Installer\8ae1d77.msp:\PCW_CAB_H15000_1:\ATPVBAEN.XLA_1033;"Contains macros";""
C:\Windows\Installer\8ae1d77.msp:\PCW_CAB_H15000_1:\EUROTOOL.XLA;"Contains macros";""
C:\Windows\Installer\8ae1d77.msp:\PCW_CAB_H15000_1:\FUNCRES.XLA_1033;"Contains macros";""
C:\Windows\Installer\8ae1d77.msp:\PCW_CAB_H15000_1:\SUMIF.XLA_1033;"Contains macros";""
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\catroot2\edb.log;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\COMPONENTS;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\COMPONENTS.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\COMPONENTS.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\DEFAULT;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\DEFAULT.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\DEFAULT.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\RegBack\COMPONENTS;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\RegBack\DEFAULT;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\RegBack\SAM;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\RegBack\SECURITY;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\RegBack\SOFTWARE;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\RegBack\SYSTEM;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SAM;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SAM.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SAM.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SECURITY;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SECURITY.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SECURITY.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SOFTWARE;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SOFTWARE.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SOFTWARE.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SYSTEM;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SYSTEM.LOG1;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\SYSTEM.LOG2;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\systemprofile\AppData\Local\History\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\systemprofile\Documents\My Music\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\systemprofile\Documents\My Pictures\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\config\systemprofile\Documents\My Videos\;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl;"Locked file. Not tested.";"Locked file. Not tested."
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl;"Locked file. Not tested.";"Locked file. Not tested."

[pskelley]

AVG Scan:-
Scan "Scheduled scan" was finished.
No infection was found during this scan

Most of the stuff AVG found are in areas it does not have access. If you don't know what those are, you should investigate. The C:\System Volume Information is probably being reported because of that lack of access. Here is information about that area:
Windows Vista System Restore Guide
http://www.bleepingcomputer.com/tutorials/tutorial143.html

Some good information for you:
http://www.netsquirrel.com/msconfig/msconfig_vista.html
Get maximum performance from Windows Vista
http://windowshelp.microsoft.com/windows/en-us/Help/596FB57F-CC9D-4AC5-A813-5C0830E9156A1033.mspx


(all information will not apply to Vista)
Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

http://www.malwarecomplaints.info/

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

http://users.telenet.be/bluepatchy/miekiemoes/Links.html

[dogwalker]

Hi,
Regarding the locked files reported in the AVG scan, I repeated the scan making sure AVG was started as administrator, the results were the same. I went to:-
http://www.bleepingcomputer.com/tutorials/tutorial143.html
regarding the locked System Volume files but couldn't find relevant info. Is there something simple I'm not seeing? Not being that familiar with Vista I've no idea why the various files should be locked to AVG or how to unlock them.

Assuming that as far as you can tell this computer is free of any infection, I will follow up all the other links you have provided.

Many thanks for all your help.
Regards

[pskelley]

I wish I could help, but I do not own Vista either. You might ask here:
AVG Free Forum: http://freeforum.avg.com/

or at a Vista forum?
http://help.lockergnome.com/vista/
http://thevistaforums.com/

[dogwalker]

I will follow up the links you've provided.
Very impressed with the service.
The lady whose computer this is has made a donation.
Thanks once again.