Malware Attack...Please Help

Status
Not open for further replies.
S

Smoke_O

New member
I have malware on my computer and it disabled ctr+alt+delete, it stalls web pages, it wont let me open and run various malware removers like Spybot and Kapersky. Here is my HJT and Malwarebytes logs.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:21:45 PM, on 6/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\webHancer\Programs\whagent.exe
C:\WINDOWS\mrofinu72.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\PROGRA~1\ASEMBL~1\tracert.exe
C:\Program Files\GetModule\GetModule18.exe
C:\WINDOWS\system32\??pPatch\??ool32.exe
C:\Program Files\GetPack\GetPack18.exe
C:\Program Files\Svconr\Svconr.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\Spcron\Spc.dll
O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
O2 - BHO: (no name) - {DE3DBC48-76D0-0352-FB3C-78A291E81E96} - C:\WINDOWS\system32\gwsoejm.dll
O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKCU\..\Run: [Microsoft Windows Installer] C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [GetModule18] "C:\Program Files\GetModule\GetModule18.exe"
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O4 - HKCU\..\Run: [GetPack18] "C:\Program Files\GetPack\GetPack18.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - HKCU\..\Run: [Svconr] C:\Program Files\Svconr\Svconr.exe
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T2x1aWdibw\command.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 16376 bytes
 
Malwarebytes' Anti-Malware 1.17
Database version: 861

10:08:39 PM 6/16/2008
mbam-log-6-16-2008 (22-08-26).txt

Scan type: Full Scan (C:\|)
Objects scanned: 240314
Time elapsed: 7 hour(s), 16 minute(s), 30 second(s)

Memory Processes Infected: 4
Memory Modules Infected: 3
Registry Keys Infected: 46
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 13
Files Infected: 112

Memory Processes Infected:
C:\WINDOWS\mrofinu72.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\GetModule\GetModule18.exe (Adware.ISM) -> No action taken.
C:\Program Files\GetPack\GetPack18.exe (Adware.ISM) -> No action taken.
C:\Program Files\webHancer\Programs\whagent.exe (Adware.Webhancer) -> No action taken.

Memory Modules Infected:
C:\Program Files\webHancer\Programs\whiehlpr.dll (Adware.WebHancer) -> No action taken.
C:\WINDOWS\system32\gwsoejm.dll (Adware.ClickSpring) -> No action taken.
C:\Program Files\webHancer\Programs\webhdll.dll (Adware.Webhancer) -> No action taken.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj.1 (Adware.WebHancer) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{c89435b0-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{c8cb3870-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fcaddc14-bd46-408a-9842-cdbe1c6d37eb} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} (Fake.Dropped.Malware) -> No action taken.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Adware.ISM) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{de3dbc48-76d0-0352-fb3c-78a291e81e96} (Adware.ClickSpring) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{de3dbc48-76d0-0352-fb3c-78a291e81e96} (Adware.ClickSpring) -> No action taken.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ism (Adware.ISM) -> No action taken.
HKEY_CURRENT_USER\Software\QdrPack (Adware.ISM) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISM (Adware.ISM) -> No action taken.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> No action taken.
HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo (Adware.PurityScan) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runner1 (Trojan.Downloader) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GetModule18 (Adware.ISM) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GetPack18 (Adware.ISM) -> No action taken.
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\webHancer Agent (Adware.Webhancer) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Installer (Trojan.Agent) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
C:\Program Files\dynamic toolbar (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache (Adware.2020search) -> No action taken.
C:\Program Files\Outerinfo (Adware.Outerinfo) -> No action taken.
C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> No action taken.
C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> No action taken.
C:\Program Files\webHancer (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs (Adware.Webhancer) -> No action taken.
C:\Program Files\ISM (Adware.ISM) -> No action taken.
C:\Program Files\QdrPack (Adware.ISM) -> No action taken.
C:\Program Files\GetPack (Trojan.Agent) -> No action taken.
C:\Program Files\iCheck (Trojan.Agent) -> No action taken.
C:\Program Files\GetModule (Trojan.Agent) -> No action taken.

Files Infected:
C:\WINDOWS\mrofinu72.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\GetModule\GetModule18.exe (Adware.ISM) -> No action taken.
C:\Program Files\GetPack\GetPack18.exe (Adware.ISM) -> No action taken.
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> No action taken.
C:\Program Files\webHancer\Programs\whiehlpr.dll (Adware.WebHancer) -> No action taken.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\gettpa118.exe (Adware.ISM) -> No action taken.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\ismtpa17.exe (Adware.ISM) -> No action taken.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\syswcc32.exe (Adware.Webhancer) -> No action taken.
C:\Program Files\iCheck\iCheck.exe (Adware.ISM) -> No action taken.
C:\Program Files\iCheck\Uninstall.exe (Adware.ISM) -> No action taken.
C:\Program Files\Outerinfo\FF\components\FF.dll (Adware.ClickSpring) -> No action taken.
C:\Program Files\QdrPack\bostrupd.exe (Trojan.Agent) -> No action taken.
C:\Program Files\QdrPack\QdrPack17.exe (Adware.ISM) -> No action taken.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP510\A0067159.exe (Adware.WebHancer) -> No action taken.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP510\A0067160.dll (Adware.WebHancer) -> No action taken.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP510\A0067161.dll (Adware.WebHancer) -> No action taken.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP510\A0068172.exe (Adware.ISM) -> No action taken.
C:\WINDOWS\system32\gwsoejm.dll (Adware.ClickSpring) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\1tb.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\celebs.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\ebay.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\ebaysm.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\ErrorLog.txt (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\games.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\gotb.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\highlight.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\hotstuff.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\hotstuffsm.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\movies.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\music.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\news.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\R1tb.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\radio.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\REALBARTB1115.cfg (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\REALBAR\Cache\sports.bmp (Adware.2020search) -> No action taken.
C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> No action taken.
C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> No action taken.
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> No action taken.
C:\Program Files\webHancer\Programs\license.txt (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\readme.txt (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\sporder.dll (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\webhdll.dll (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\whagent.exe (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\whagent.ini (Adware.Webhancer) -> No action taken.
C:\Program Files\webHancer\Programs\whinstaller.exe (Adware.Webhancer) -> No action taken.
C:\Program Files\ISM\Uninstall.exe (Adware.ISM) -> No action taken.
C:\Program Files\GetPack\dictame.gz (Trojan.Agent) -> No action taken.
C:\Program Files\GetPack\trgtame.gz (Trojan.Agent) -> No action taken.
C:\Program Files\GetModule\dicik.gz (Trojan.Agent) -> No action taken.
C:\Program Files\GetModule\kwdik.gz (Trojan.Agent) -> No action taken.
C:\Program Files\GetModule\pckik.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\explore.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\iexplorer.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\x.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\y.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\xxxvideo.hta (Trojan.Agent) -> No action taken.
C:\WINDOWS\default.htm (Trojan.Agent) -> No action taken.
C:\WINDOWS\svchost32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\loader.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\internet.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\16927.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\accesss.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\astctl32.ocx (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\avpcc.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\clrssn.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\cpan.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\ctfmon32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\ctrlpan.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\directx32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\dnsrelay.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\editpad.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\explorer32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\funniest.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\funny.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\gfmnaaa.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\helpcvs.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\iedll.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\inetinf.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\msconfd.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\msspi.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\mssys.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\msupdate.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\mswsc10.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\mswsc20.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\mtwirl32.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\notepad32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\olehelp.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\qttasks.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\quicken.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\rundll16.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32\clbdll.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\000070.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\000080.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\rundll32.vbe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\searchword.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\sistem.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\svcinit.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\systeem.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\systemcritical.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\time.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\users32.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\waol.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\win32e.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\win64.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\winajbm.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\window.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\winmgnt.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\xplugin.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32\drivers\clbdriver.sys (Rootkit.Agent) -> No action taken.
C:\Program Files\Common Files\Yazzle1552OinAdmin.exe (Adware.PurityScan) -> No action taken.
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe (Adware.PurityScan) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\dat61.tmp (Trojan.Agent) -> No action taken.
 
Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Seems like you are posting again and again, are you paying any attention to the information you are being provided by these helpers? Stuff happens, but you should not be getting infected and posting again and again.

If you still need help, read the directions posted above and pinned to the top of this forum, especially this one:
Do NOT run 'FIXES' before helpers have analyzed the HJT log
http://forums.spybot.info/showthread.php?t=16806
Click to expand...

Malwarebytes' Anti-Malware 1.17
10:08:39 PM 6/16/2008
No action taken <<< see this

Run MBAM again and choose to delete what it finds, then restart the computer. Once you have done that, post a new HJT log.

Thanks
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:35:13 PM, on 6/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ASEMBL~1\tracert.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9138 bytes
 
I am sorry, I should have specified the MBAM log, please scan again, remove what it finds and post the scan results.

Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post contents of that file & a new HJT log in your next reply.

Make sure the HJT log is created after you have finished removing what MBAM located and restarted your computer.

Thanks
 
Malwarebytes' Anti-Malware 1.17
Database version: 861

11:41:10 PM 6/22/2008
mbam-log-6-22-2008 (23-41-08).txt

Scan type: Full Scan (C:\|)
Objects scanned: 239306
Time elapsed: 4 hour(s), 24 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{dc3be418-7081-5c50-ac3c-78a291ef4fce} (Adware.ClickSpring) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc3be418-7081-5c50-ac3c-78a291ef4fce} (Adware.ClickSpring) -> Quarantined and deleted successfully.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo (Adware.PurityScan) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Outerinfo\FF\components\FF.dll (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP517\A0069580.dll (AdWare.CommAd) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP518\A0069712.exe (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pvieawv.dll (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\OiUninstaller.exe (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\outerinfo.ico (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clbinit.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
 
Let me take a moment to explain how this works. HJT is a diagnostic tool that shows a picture of the places malware hackers usually place their junk. It cannot show it all, it would have to be hugh. We use the tools like MBAM to reach hidden malware, but we need to look at the HJT log to see what the tool accomplished. In summation, and I usually ask for it as I did here:
Please post contents of that file & a new HJT log in your next reply
Click to expand...
I always need to see a HJT log after a tool has been run.

So...if you would be so kind as to post a fresh HJT log that was run after MBAM removed what junk it could, I will look at see what else may be needing removal from your computer. I always appreciate feedback, so add any comments you think will help.

Thanks...Phil
 
Hello, you keep saying HJT is that the HijackTrend log. if so do you want BOTH the HijackTrend log and MBAM log? Also MBAM log wasnt finding the viruses so I ran Kaspersky and it found loads of junk. Should I post that too? Thanks
 
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

All I need is the HJT log, the MBAM log is posted.

If it is from the Kaspersky Online Scan, post it.
 
Last edited:
KASPERSKY ONLINE SCANNER REPORT
Wednesday, June 25, 2008 10:09:01 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/06/2008
Kaspersky Anti-Virus database records: 884005
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 189122
Number of viruses found: 44
Number of infected objects: 253
Number of suspicious objects: 0
Duration of the scan process: 04:22:27

Infected Object Name / Virus Name / Last Action
C:\23100247.exe Infected: Backdoor.Win32.Haxdoor.je skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea563f5ed0b8ea72081a19b9b561dd25_9e2917f4-b3ab-4a25-8f86-18864f18394f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\ACS\1.0\ph Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\ACS\1.0\variable Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\idb\OOluigbo\mydb.idx Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\idb\OOluigbo\style.lst Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\idb\OOluigbo\toolbar.lst Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\idb\SNMaster.idx Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\organize\CACHE\ooluig02 Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\organize\ooluigbo Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\organize\ooluigbo.abi Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\C_America Online 9.0e\organize\ooluigbo.aby Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\aolstderr.txt Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\aolstdout.txt Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\aoltsmon.lock Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\cache.db Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\TopSpeed\2.0\server.lock Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\UserProfiles\All Users\BFTS\BFTSDatabase.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\ACZ\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\AGE\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5146.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5146.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5146.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5146.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51538.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51538.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51538.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51538.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516A9.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516A9.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516A9.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs516A9.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51C.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51C.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51C.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs51C.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs538.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs538.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs538.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs538.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs557.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs557.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs557.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs557.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs56420.tmpbsx32\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs56420.tmpbsx32\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs56420.tmpbsx32\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs56420.tmpbsx32\sah.exe NSIS: infected - 3 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5C48.tmpbsx32\motor2b.exe/data0002 Infected: Trojan-Downloader.Win32.VB.df skipped
C:\Documents and Settings\Owner\Local Settings\Temp\bs5C48.tmpbsx32\motor2b.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temp\cfg2F.tmpcfgmgr52\bbi2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\CQE\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\ISZ\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\JND\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\KAE\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.u skipped
C:\Documents and Settings\Owner\Local Settings\Temp\MOL\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.u skipped
C:\Documents and Settings\Owner\Local Settings\Temp\QVG\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\ROH\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\SMK\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\SMV\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\SQC\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temp\WGK\aurareco.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.a skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[2].cab/MediaGatewayX.dll Infected: not-a-virus:AdWare.Win32.WinAD.bv skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[2].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[3].cab/MediaGatewayX.dll Infected: not-a-virus:AdWare.Win32.WinAD.bv skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[3].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[4].cab/MediaGatewayX.dll Infected: not-a-virus:AdWare.Win32.WinAD.bv skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PINW5QB\bridge-c8[4].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\58SB9XG5\emCraft1[1].cab/ATPartners.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.c skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\58SB9XG5\emCraft1[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\Browser_Plugin[1].cab/242656.exe Infected: Trojan-Downloader.Win32.Small.fz skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\Browser_Plugin[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\STATS4[1].CHM/stats4.htm Infected: Trojan-Downloader.JS.Psyme.n skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\STATS4[1].CHM CHM: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\STATS4[2].CHM/stats4.htm Infected: Trojan-Downloader.JS.Psyme.n skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NUN6TM7\STATS4[2].CHM CHM: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IRMZMXYN\hp1[1].exe/data0002 Infected: not-a-virus:AdWare.Win32.BookedSpace.c skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IRMZMXYN\hp1[1].exe NSIS: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M97W5CB6\downloader[1].ocx Infected: Trojan-Downloader.Win32.VB.mk skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M97W5CB6\emCraft1[1].cab/ATPartners.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.c skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M97W5CB6\emCraft1[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\popup[1].php Infected: Trojan-Downloader.JS.IstBar.q skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[1].txt/index.exe Infected: Trojan-Dropper.Win32.Delf.ev skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[1].txt/index.htm Infected: Trojan-Downloader.VBS.Psyme.a skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[1].txt CHM: infected - 2 skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[2].txt/index.exe Infected: Trojan-Dropper.Win32.Delf.ev skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[2].txt/index.htm Infected: Trojan-Downloader.VBS.Psyme.a skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UV14MBGW\sia[2].txt CHM: infected - 2 skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\Apps.Lst Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\art.idx Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\sap.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\spool.lst Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AOL\C_America Online 9.0e\IDB\sysnews.lst Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.32158 Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.40157/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.40157 NSIS: infected - 1 skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.70062 Infected: Trojan-Downloader.Win32.PurityScan.gb skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Verizon\VSP\client_gateway.log Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\History\History.IE5\MSHist012008062520080626\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt101.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt108.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt10F.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1106.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt117.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt11E.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt125.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt12C.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt133.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt13A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1409.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt142.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt14A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt151.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt158.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt15F.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt166.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt16D.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt174.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt17B.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt182.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1850.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt18A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt191.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt198.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1A1.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1A8.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1AF.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1B.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1B6.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1BD.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1C30.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1C4.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1CB.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1D3.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1DA.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1E1.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1E8.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1EA.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt1F5D.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt20F.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt22.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt22C.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt22D9.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt25.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt253.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt25A0.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt260.tmp/stream/data0008 Infected: not-a-virus:FraudTool.Win32.WinFixer.i skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt260.tmp/stream Infected: not-a-virus:FraudTool.Win32.WinFixer.i skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt260.tmp NSIS: infected - 2 skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt276.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2872.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt297.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2AB.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2BF.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2C.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2D4.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2D44.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2E8.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt2FD.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt306C.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt311.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt325.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt3290.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt33.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt3A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt47.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt55.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt568.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt60.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt6A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt6A2.tmp Infected: Trojan.Win32.Pakes.czg skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt71.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt79.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt82.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt8A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt92.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt9A.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttA3.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttAD.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttB4.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttBB.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttC2.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttC9.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttD0.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttD9.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttDAC.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttE2.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttEB.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttF3.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.ttFA.tmp Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\bbbbti.exe Infected: not-virus:Hoax.Win32.Renos.daw skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\FTJs.exe Infected: Rootkit.Win32.HideProc.i skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\ntuser.dat.LOG Object is locked skipped
C:\I386\DRIVER.CAB/i8042prt.sys Infected: not-a-virus:Monitor.Win32.UberKeylogger.b skipped
C:\I386\DRIVER.CAB CAB: infected - 1 skipped
C:\Program Files\aѕsembly\tracert.exe Infected: Trojan-Downloader.Win32.Agent.kwg skipped
C:\Program Files\CA\PPRT\logs\2008-06-25.csv Object is locked skipped
C:\Program Files\Norton AntiVirus\Quarantine\218B5514 Infected: Trojan-Downloader.Win32.Small.fz skipped
C:\Program Files\Norton AntiVirus\Quarantine\4D952FE3 Infected: not-a-virus:Porn-Dialer.Win32.RTSMini skipped
C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe Infected: not-a-virus:FraudTool.Win32.WinFixer.i skipped
C:\Program Files\vol_toolbar\vol_toolbar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.p skipped
C:\Program Files\Windows Media Player\wmplayer.exe.tmp/data0002 Infected: not-a-virus:AdWare.Win32.BookedSpace.c skipped
C:\Program Files\Windows Media Player\wmplayer.exe.tmp NSIS: infected - 1 skipped
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\SuppLog.txt Object is locked skipped
C:\System Volume Information\_restore{20DA0542-C5BC-457A-A132-6EDD7E94FA67}\RP520\change.log Object is locked skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP715\A0083276.exe Infected: not-a-virus:AdWare.Win32.Bestofer.d skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084207.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.j skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084211.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.j skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084213.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084214.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084214.exe/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.y skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084214.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP734\A0084216.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Driver Cache\i386\driver.cab/i8042prt.sys Infected: not-a-virus:Monitor.Win32.UberKeylogger.b skipped
C:\WINDOWS\Driver Cache\i386\driver.cab CAB: infected - 1 skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{49D95C30-383B-4AAF-A84E-64F8B819F92E}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\1xhFPd.syz Infected: Rootkit.Win32.HideProc.i skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\DGPSZv.syz Infected: Rootkit.Win32.HideProc.i skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\lphcefhj0er0g.exe Infected: Trojan.Win32.Pakes.deo skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\ΑрpPatch\ѕрool32.exe Infected: not-a-virus:AdWare.Win32.PurityScan.id skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINNT\$NtUninstallKB824141$\user32.dll Object is locked skipped
C:\WINNT\$NtUninstallKB824141$\win32k.sys Object is locked skipped
C:\WINNT\$NtUninstallKB828028$\msasn1.dll Object is locked skipped
C:\WINNT\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped
C:\WINNT\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped
C:\WINNT\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped
C:\WINNT\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped
C:\WINNT\Ajccylqdgcy.hba\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Aowctdjnz.gdd\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Aowctdjnz.gdd\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Aowctdjnz.gdd\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Aowctdjnz.gdd\sah.exe NSIS: infected - 3 skipped
C:\WINNT\asatbano.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\Bdgwceuxq.drz\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Bdgwceuxq.drz\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Bdgwceuxq.drz\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Bdgwceuxq.drz\sah.exe NSIS: infected - 3 skipped
C:\WINNT\bs7beta.exe Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\Btlhpmv.egd\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Btlhpmv.egd\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Btlhpmv.egd\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Btlhpmv.egd\sah.exe NSIS: infected - 3 skipped
C:\WINNT\cmpmyh.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.ai skipped
C:\WINNT\Cmrhrwt.hrc\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cmrhrwt.hrc\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cmrhrwt.hrc\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cmrhrwt.hrc\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Cpqeaygvf.ebo\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cpqeaygvf.ebo\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cpqeaygvf.ebo\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Cpqeaygvf.ebo\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Driver Cache\i386\driver.cab/i8042prt.sys Infected: not-a-virus:Monitor.Win32.UberKeylogger.b skipped
C:\WINNT\Driver Cache\i386\driver.cab CAB: infected - 1 skipped
C:\WINNT\Etlukfjbfkh.qtt\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Etlukfjbfkh.qtt\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Etlukfjbfkh.qtt\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Etlukfjbfkh.qtt\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Gkwaiowfy.smd\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Gkwaiowfy.smd\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Gkwaiowfy.smd\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Gkwaiowfy.smd\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Hfzdssaxhj.pcb\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Hqqjyjpbsk.tle\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hqqjyjpbsk.tle\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hqqjyjpbsk.tle\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hqqjyjpbsk.tle\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Hsgdkznznfj.nwq\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hsgdkznznfj.nwq\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hsgdkznznfj.nwq\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hsgdkznznfj.nwq\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Htzucaj.fbv\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Hysbbzcg.dob\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hysbbzcg.dob\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hysbbzcg.dob\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Hysbbzcg.dob\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ibzksuon.rqs\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Inalnomtp.lsr\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Ionmfzqsiyz.sjj\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ionmfzqsiyz.sjj\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ionmfzqsiyz.sjj\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ionmfzqsiyz.sjj\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Jxexazcn.ckd\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Jxexazcn.ckd\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Jxexazcn.ckd\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Jxexazcn.ckd\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Kucyxjddt.ypd\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Kwngnwnalh.pgk\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Kwngnwnalh.pgk\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Kwngnwnalh.pgk\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Kwngnwnalh.pgk\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Lazzjcsavv.upq\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Lazzjcsavv.upq\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Lazzjcsavv.upq\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Lazzjcsavv.upq\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Livrkzfwq.sfi\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Livrkzfwq.sfi\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Livrkzfwq.sfi\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Livrkzfwq.sfi\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Moimlpgltq.jmg\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Moimlpgltq.jmg\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Moimlpgltq.jmg\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Moimlpgltq.jmg\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ojuwbirjvsw.ftl\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ojuwbirjvsw.ftl\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ojuwbirjvsw.ftl\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ojuwbirjvsw.ftl\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ontnsay.tjl\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Otjyvhcso.asm\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Otjyvhcso.asm\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Otjyvhcso.asm\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Otjyvhcso.asm\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Przjrkql.yxv\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Qmqmrblddx.ral\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Qsxyojyks.fup\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Qsxyojyks.fup\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Qsxyojyks.fup\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Qsxyojyks.fup\sah.exe NSIS: infected - 3 skipped
C:\WINNT\rk.exe Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skipped
C:\WINNT\robvdilyisf.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.bd skipped
C:\WINNT\sahagent-fellymedia1002.exe/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\sahagent-fellymedia1002.exe NSIS: infected - 1 skipped
C:\WINNT\Shnxophp.hly\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\sjhjlbdm.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\spsyllwh.exe Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\Sqqubgxuh.ysc\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Sqqubgxuh.ysc\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Sqqubgxuh.ysc\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Sqqubgxuh.ysc\sah.exe NSIS: infected - 3 skipped
C:\WINNT\svcproc.exe Infected: Trojan.Win32.Stervis.c skipped
C:\WINNT\system32\exdl.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.j skipped
C:\WINNT\system32\exul.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.n skipped
C:\WINNT\system32\install2.exe Infected: Trojan.Win32.SecondThought.l skipped
C:\WINNT\system32\pup.exe/WISE0005.BIN Infected: Trojan.Win32.Revop.c skipped
C:\WINNT\system32\pup.exe WiseSFX: infected - 1 skipped
C:\WINNT\system32\silent.exe/data0002 Infected: not-a-virus:AdWare.Win32.WinFetcher.b skipped
C:\WINNT\system32\silent.exe/data0003/data0002 Infected: not-a-virus:AdWare.Win32.WinFetcher.b skipped
C:\WINNT\system32\silent.exe/data0003 Infected: not-a-virus:AdWare.Win32.WinFetcher.b skipped
C:\WINNT\system32\silent.exe NSIS: infected - 3 skipped
C:\WINNT\Tdpnusrktjw.vfb\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Temp\bs5598.tmpbsx32\cg.exe/data0002 Infected: Trojan-Downloader.Win32.Agent.i skipped
C:\WINNT\Temp\bs5598.tmpbsx32\cg.exe NSIS: infected - 1 skipped
C:\WINNT\Temp\pq_debug.tmp Infected: not-a-virus:AdWare.Win32.BookedSpace.f skipped
C:\WINNT\Tsrdltseaam.ata\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Tugykcdljil.bvj\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Tugykcdljil.bvj\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Tugykcdljil.bvj\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Tugykcdljil.bvj\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ufjcxmwrfh.taz\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ufjcxmwrfh.taz\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ufjcxmwrfh.taz\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ufjcxmwrfh.taz\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Umgkulki.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.g skipped
C:\WINNT\Utzoylica.bmg\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Utzoylica.bmg\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Utzoylica.bmg\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Utzoylica.bmg\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Vbxukykbguk.tlu\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Vnvoqbro.riz\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Wxsstnmqk.opw\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINNT\Wzbvyed.yts\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Wzbvyed.yts\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Wzbvyed.yts\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Wzbvyed.yts\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Xlaxvvqxznd.yjx\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Xlaxvvqxznd.yjx\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Xlaxvvqxznd.yjx\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Xlaxvvqxznd.yjx\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Ymhfhdyfph.xzx\sah.exe/stream/data0001/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ymhfhdyfph.xzx\sah.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ymhfhdyfph.xzx\sah.exe/stream Infected: not-a-virus:AdWare.Win32.Sahat.h skipped
C:\WINNT\Ymhfhdyfph.xzx\sah.exe NSIS: infected - 3 skipped
C:\WINNT\Zbxrbfi.qnf\BBI2.exe Infected: Trojan-Downloader.Win32.Adload.a skipped

Scan process completed.
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:48 AM, on 6/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\PROGRA~1\ASEMBL~1\tracert.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temp\.tt205.tmp
C:\WINDOWS\system32\??pPatch\??ool32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {8A3CEF4B-778F-0F5E-AC3C-78A291EF4394} - C:\WINDOWS\system32\mrxl.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lphcefhj0er0g] C:\WINDOWS\system32\lphcefhj0er0g.exe
O4 - HKLM\..\Run: [SMrhcafhj0er0g] C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O21 - SSODL: Rcagps - {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9838 bytes
 
This computer is in pretty bad shape, how did you allow it to get like this? You must keep it offline until we get it clean or we are wasting our time, the junk will continue to download more. You should be online only long enough to get and follow my directions. Print them so you can get back offline, we will start with combofix, these directions must be followed exactly.

Remove any old copies of combofix before you proceed.

Thanks to sUBs and anyone else who helped with this fix.

It is important that it is saved directly to your Desktop

Download ComboFix from Here to your Desktop
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Post the combofix log and a new HJT log.

Tutorial
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Thanks
 
Yes I know this computer is in bad shape. Its my mother's and she doesnt maintain it. It doesnt have any anti-virus protection so its just a mess right now. Here are the logs


ComboFix 08-06-20.4 - Owner 2008-06-28 12:28:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.648 [GMT -4:00]
Running from: C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\23100247.exe
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\CPV.stt
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Microsoft\dtsc\s
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\RACLE~1
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temporary Internet Files\bestwiner.stt
C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Local Settings\Temporary Internet Files\CPV.stt
C:\Program Files\asembl~1
C:\Program Files\asembl~1\a?sembly\
C:\Program Files\asembl~1\tracert.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\racle~1
C:\WINDOWS\system32\1xhFPd.syz
C:\WINDOWS\system32\9.tmp
C:\WINDOWS\system32\DGPSZv.syz
C:\WINDOWS\system32\hljwugsf.bin
C:\WINDOWS\system32\mrxl.dll
C:\WINDOWS\system32\ppatch~1
C:\WINDOWS\system32\ppatch~1\??ool32.exe
C:\WINDOWS\system32\sstem~1
C:\WINDOWS\system32\sysrest.sys
C:\WINDOWS\system32\sysrest32.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLBDRIVER
-------\Legacy_CMDSERVICE
-------\Legacy_NETWORK_MONITOR
-------\Legacy_SYSREST.SYS
-------\Service_clbdriver
-------\Service_sysrest.sys


((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-28 )))))))))))))))))))))))))))))))
.

2008-06-26 18:41 . 2008-06-26 18:41 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer
2008-06-26 18:38 . 2008-06-26 18:41 <DIR> d-------- C:\Program Files\AXPFixer
2008-06-24 12:17 . 2008-06-24 12:17 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g
2008-06-24 12:17 . 2008-06-28 12:50 94,208 --a------ C:\WINDOWS\system32\pphcefhj0er0g.exe
2008-06-23 23:56 . 2008-06-24 12:17 <DIR> d-------- C:\Program Files\rhcafhj0er0g
2008-06-23 23:54 . 2008-06-28 12:50 90,838 --a------ C:\WINDOWS\system32\phcefhj0er0g.bmp
2008-06-23 23:54 . 2008-06-28 12:50 60,928 --a------ C:\WINDOWS\system32\blphcefhj0er0g.scr
2008-06-23 23:53 . 2008-06-23 23:53 109,056 --a------ C:\WINDOWS\system32\lphcefhj0er0g.exe
2008-06-17 03:53 . 2008-06-21 15:28 <DIR> d--hs---- C:\WINDOWS\T2x1aWdibw
2008-06-16 14:20 . 2008-06-16 14:20 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-16 14:20 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 14:19 . 2008-06-16 14:19 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-16 14:19 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-16 00:29 . 2008-06-16 00:29 4,286 --a------ C:\WINDOWS\system32\Jamster.ico
2008-06-15 02:51 . 2008-06-15 02:51 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\Viewpoint
2008-06-15 02:50 . 2008-06-15 02:50 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\AOL
2008-06-15 02:49 . 2008-06-15 02:49 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2
2008-06-15 02:15 . 2008-06-15 02:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-06-15 01:20 . 2008-06-15 01:20 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-06-15 01:06 . 2002-09-03 09:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-15 01:05 . 2008-06-15 01:05 <DIR> d-------- C:\Program Files\uTorrent
2008-06-15 01:05 . 2008-06-21 15:30 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\uTorrent
2008-06-10 16:45 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-27 04:39 316 ----a-w C:\drmHeader.bin
2008-06-27 02:26 --------- d-----w C:\Program Files\DivX
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-23 15:16 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-22 22:22 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-05-22 22:22 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-05-22 22:22 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-05-22 07:29 --------- d-----w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Apple Computer
2008-05-15 20:08 --------- d-----w C:\Program Files\iTunes
2008-05-15 20:07 --------- d-----w C:\Program Files\iPod
2008-05-15 20:06 --------- d-----w C:\Program Files\Bonjour
2008-05-15 20:05 --------- d-----w C:\Program Files\QuickTime
2008-05-15 20:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-05-15 20:03 --------- d-----w C:\Program Files\Apple Software Update
2008-05-15 20:02 --------- d-----w C:\Program Files\Common Files\Apple
2008-05-15 20:02 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-05-14 04:29 --------- d-----w C:\Program Files\Movie Joiner
2008-05-13 21:01 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Motive
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2006-08-11 00:47 17,528 ----a-w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\GDIPFONTCACHEV1.DAT
2003-11-15 20:22 58,264 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2005-07-29 20:24 472 --sha-r C:\WINDOWS\T2x1aWdibw\nZUYuqx2vT.vbs
.

------- Sigcheck -------

2002-09-03 09:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 03:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
2008-06-26 05:36 16896 35de7705f9fb23992740523b5c9fdac5 C:\WINDOWS\system32\svchost.exe

2002-09-03 09:00 516608 2246d8d8f4714a2cedb21ab9b1849abb C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 03:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2004-08-04 03:56 505856 481addbb21037489eacfcb308b1be2b0 C:\WINDOWS\system32\winlogon.exe

md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2002-09-03 09:00 1004032 a82b28bfc2e4455fe43022a498c0ef0a C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2002-09-03 09:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-04 03:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe
2004-08-04 03:56 110080 77f48ea251a503aae5fc0e7af4a425d7 C:\WINDOWS\system32\services.exe

2002-09-03 09:00 11776 b2b6ba905d0e3f8a32a0eb3b4051807b C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-04 03:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
2004-08-04 03:56 14336 d1320ba74a3866c2859b0518080cf84c C:\WINDOWS\system32\lsass.exe
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 50,736 2006-09-26 00:52:48 C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe
----a-w 48,280 2006-03-10 22:22:57 C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe

----a-w 153,168 2006-11-20 20:42:15 C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe

----a-r 71,216 2006-10-23 12:50:37 C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe

----a-w 49,263 2006-11-09 20:07:30 C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe

----a-w 460,336 2005-10-19 17:13:08 C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe

----a-w 116,272 2005-08-18 21:57:50 C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe

----a-w 992,808 2006-03-07 20:05:20 C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe

----a-w 110,592 2002-08-02 18:41:08 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe

----a-w 98,304 2006-08-28 23:16:07 C:\Program Files\QuickTime\bak\qttask.exe
----a-w 413,696 2008-03-29 03:37:20 C:\Program Files\QuickTime\QTTask.exe

----a-w 26,112 2006-06-21 08:29:38 C:\Program Files\Real\RealPlayer\bak\RealPlay.exe
----a-w 26,112 2007-08-29 23:02:17 C:\Program Files\Real\RealPlayer\realplay.exe

----a-w 114,688 2006-06-20 03:18:53 C:\WINDOWS\system32\bak\hkcmd.exe

----a-w 155,648 2006-06-20 03:19:05 C:\WINDOWS\system32\bak\igfxtray.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ltho"="C:\PROGRA~1\ASEMBL~1\tracert.exe" [ ]
"Jzjirr"="C:\WINDOWS\system32\??pPatch\??ool32.exe" [ ]
"AOL Fast Start"="C:\Program Files\America Online 9.0e\AOL.EXE" [2005-07-12 06:17 50776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"HostManager"="C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe" [2006-03-10 18:22 48280]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [ ]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [ ]
"AOLSPScheduler"="C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe" [2006-11-20 16:42 8784]
"sscRun"="C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe" [ ]
"OASClnt"="C:\Program Files\mcafee.com\antivirus\oasclnt.exe" [ ]
"EmailScan"="C:\Program Files\mcafee.com\antivirus\mcvsescn.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [ ]
"MPFExe"="C:\Program Files\mcafee.com\personal firewall\MPfTray.exe" [ ]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 17:42 79448]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-08-29 19:02 26112]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 19:52 936960]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 15:20 2061816]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"lphcefhj0er0g"="C:\WINDOWS\system32\lphcefhj0er0g.exe" [2008-06-23 23:53 109056]
"SMrhcafhj0er0g"="C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe" [2008-06-21 14:22 1642496]
"sysrest32.exe"="C:\WINDOWS\system32\sysrest32.exe" [ ]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ZyXEL G-220 v2 Wireless Adapter Utility.lnk - C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe [2007-09-17 16:11:27 10891264]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)
"NoDispScrSavPage"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Rcagps"= {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll [2007-04-16 11:52 32768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgm.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgs.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
--a------ 2002-10-03 20:50 684032 C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
--------- 2001-01-03 15:50 66048 C:\WINDOWS\system32\SK9910DM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PROMon.exe]
--a------ 2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2007-08-29 19:02 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0e\\waol.exe"=
"C:\\Program Files\\ZyXEL\\ZyXEL G-220 v2 Wireless Adapter Utility\\ZyXEL G-220 v2.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R2 RioPNP;RioPNP;C:\WINDOWS\system32\drivers\RioPNP.sys [2000-06-06 10:29]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;C:\WINDOWS\System32\ZDCNDIS5.sys [2006-08-17 10:03]
R3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanGZXP.sys [2006-08-17 10:03]
S1 seppgm;TCP x IP2 Kernel;C:\WINDOWS\System32\seppgm.sys []
S2 seppgs;TCP x IP2 Kernel32;C:\WINDOWS\System32\seppgm.sys []
S3 {BEE686B9-4C84-4487-9D72-9F40F051E973};{BEE686B9-4C84-4487-9D72-9F40F051E973};C:\WINDOWS\System32\svchost.exe [2008-06-26 05:36]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
{BEE686B9-4C84-4487-9D72-9F40F051E973}

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-28 12:51:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{BEE686B9-4C84-4487-9D72-9F40F051E973}]
"ServiceDll"="C:\DOCUME~1\OWNER~1.OLU\LOCALS~1\Temp\25E.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\McShield.exe
C:\Program Files\mcafee.com\personal firewall\MpfService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\America Online 9.0e\shellmon.exe
.
**************************************************************************
.
Completion time: 2008-06-28 13:10:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-28 17:10:18

Pre-Run: 8,581,869,568 bytes free
Post-Run: 11,257,212,928 bytes free

257 --- E O F --- 2008-06-20 06:54:47
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:43 PM, on 6/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lphcefhj0er0g] C:\WINDOWS\system32\lphcefhj0er0g.exe
O4 - HKLM\..\Run: [SMrhcafhj0er0g] C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O21 - SSODL: Rcagps - {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9288 bytes
 
She has an AWF infection also, let's hope combofix will remove it for us?

I see McAfee Antivirus and Personal Firewall, are they not up to date and running?

Follow the directions carefully and in the numbered order.

1) C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove programs.
http://www.greatis.com/appdata/u/v/viewmgr.exe.htm
http://www.spywareinfo.com/newsletter/archives/2005/nov4.php#viewpoint
http://www.clickz.com/news/article.php/3561546

2) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm. Click OK.
You may reverse this for safety when we are finished.

3) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

(follow the CFScript instructions carefully!)

4) Open notepad and copy/paste the text in the codebox below into it:

Code: 
AWF
C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe
C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe
C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe
C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe
C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe
C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe
C:\Program Files\QuickTime\bak\qttask.exe
C:\Program Files\Real\RealPlayer\bak\RealPlay.exe
C:\WINDOWS\system32\bak\hkcmd.exe
C:\WINDOWS\system32\bak\igfxtray.exe

File::
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\WINDOWS\system32\fyudix.dll
C:\WINDOWS\system32\sysrest32.exe

Folder::
C:\Program Files\rhcafhj0er0g

Save this as CFScript

CFScript.gif


Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)

5) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
(next toolbar is damaged, download it again once we finish if you use it)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O4 - HKLM\..\Run: [lphcefhj0er0g] C:\WINDOWS\system32\lphcefhj0er0g.exe
O4 - HKLM\..\Run: [SMrhcafhj0er0g] C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKCU\..\Run: [Ltho] "C:\PROGRA~1\ASEMBL~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Jzjirr] C:\WINDOWS\system32\??pPatch\??ool32.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O21 - SSODL: Rcagps - {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll

Close all programs but HJT and all browser windows, then click on "Fix Checked"

6) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.


Restart and post the combofix log from CFScript, a new HJT log and any information I requested.
Add any comments you think will help.

Thanks
 
Hopefully the scan took some of the junk off the computer. The program file C:\Program Files\rhcafhj0er0g is still there. But I think some of its components were deleted. Well here are the logs.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:51:39 PM, on 6/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1150817884\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\America Online 9.0e\shellmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0e\AOL.EXE" -b
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 8148 bytes
 
ComboFix 08-06-20.4 - Owner 2008-06-29 11:19:31.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.652 [GMT -4:00]
Running from: C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Desktop\CFScript.txt
* Resident AV is active


FILE ::
C:\WINDOWS\system32\fyudix.dll
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\WINDOWS\system32\sysrest32.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\rhcafhj0er0g
C:\Program Files\rhcafhj0er0g\database.dat
C:\Program Files\rhcafhj0er0g\license.txt
C:\Program Files\rhcafhj0er0g\MFC71.dll
C:\Program Files\rhcafhj0er0g\MFC71ENU.DLL
C:\Program Files\rhcafhj0er0g\msvcp71.dll
C:\Program Files\rhcafhj0er0g\msvcr71.dll
C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe
C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe.local
C:\Program Files\rhcafhj0er0g\rhcafhj0er0gSkin.dll
C:\Program Files\rhcafhj0er0g\Uninstall.exe
C:\WINDOWS\system32\fyudix.dll
C:\WINDOWS\system32\lphcefhj0er0g.exe
C:\WINDOWS\system32\pphcefhj0er0g.exe
C:\WINDOWS\system32\sysrest.sys
C:\WINDOWS\system32\sysrest32.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SYSREST.SYS
-------\Service_sysrest.sys


((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-29 )))))))))))))))))))))))))))))))
.

2008-06-26 18:41 . 2008-06-26 18:41 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\AXPFixer
2008-06-26 18:38 . 2008-06-26 18:41 <DIR> d-------- C:\Program Files\AXPFixer
2008-06-24 12:17 . 2008-06-24 12:17 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\rhcafhj0er0g
2008-06-23 23:54 . 2008-06-29 10:52 90,838 --a------ C:\WINDOWS\system32\phcefhj0er0g.bmp
2008-06-23 23:54 . 2008-06-29 10:53 60,928 --a------ C:\WINDOWS\system32\blphcefhj0er0g.scr
2008-06-17 03:53 . 2008-06-21 15:28 <DIR> d--hs---- C:\WINDOWS\T2x1aWdibw
2008-06-16 14:20 . 2008-06-16 14:20 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-16 14:20 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 14:19 . 2008-06-16 14:19 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-06-16 14:19 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-16 14:19 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-16 00:29 . 2008-06-16 00:29 4,286 --a------ C:\WINDOWS\system32\Jamster.ico
2008-06-15 02:51 . 2008-06-15 02:51 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\Viewpoint
2008-06-15 02:50 . 2008-06-15 02:50 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2\Application Data\AOL
2008-06-15 02:49 . 2008-06-15 02:49 <DIR> d-------- C:\Documents and Settings\Administrator.OLUIGBO-9MC03P2
2008-06-15 02:15 . 2008-06-15 02:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-15 02:03 . 2008-06-15 02:03 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-06-15 01:20 . 2008-06-15 01:20 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-06-15 01:06 . 2002-09-03 09:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-15 01:05 . 2008-06-15 01:05 <DIR> d-------- C:\Program Files\uTorrent
2008-06-15 01:05 . 2008-06-21 15:30 <DIR> d-------- C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\uTorrent
2008-06-10 16:45 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-29 15:12 --------- d-----w C:\Program Files\Viewpoint
2008-06-29 15:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
2008-06-27 04:39 316 ----a-w C:\drmHeader.bin
2008-06-27 02:26 --------- d-----w C:\Program Files\DivX
2008-06-26 09:36 16,896 ----a-w C:\WINDOWS\system32\svchost.exe
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-05-23 15:16 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-22 22:22 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-05-22 22:22 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-05-22 22:22 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-05-22 22:22 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-05-22 22:22 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-05-22 22:22 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-05-22 22:22 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-05-22 22:22 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-22 07:29 --------- d-----w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\Apple Computer
2008-05-15 20:08 --------- d-----w C:\Program Files\iTunes
2008-05-15 20:07 --------- d-----w C:\Program Files\iPod
2008-05-15 20:06 --------- d-----w C:\Program Files\Bonjour
2008-05-15 20:05 --------- d-----w C:\Program Files\QuickTime
2008-05-15 20:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-05-15 20:03 --------- d-----w C:\Program Files\Apple Software Update
2008-05-15 20:02 --------- d-----w C:\Program Files\Common Files\Apple
2008-05-15 20:02 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-05-14 04:29 --------- d-----w C:\Program Files\Movie Joiner
2008-05-13 21:01 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Motive
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2006-08-11 00:47 17,528 ----a-w C:\Documents and Settings\Owner.OLUIGBO-9MC03P2\Application Data\GDIPFONTCACHEV1.DAT
2003-11-15 20:22 58,264 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2005-07-29 20:24 472 --sha-r C:\WINDOWS\T2x1aWdibw\nZUYuqx2vT.vbs
.

------- Sigcheck -------

2002-09-03 09:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 03:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
2008-06-26 05:36 16896 35de7705f9fb23992740523b5c9fdac5 C:\WINDOWS\system32\svchost.exe

2002-09-03 09:00 516608 2246d8d8f4714a2cedb21ab9b1849abb C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 03:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2004-08-04 03:56 505856 481addbb21037489eacfcb308b1be2b0 C:\WINDOWS\system32\winlogon.exe

2007-06-13 06:23 1035264 666c5d9dbced0cdfd48285103f8e2808 C:\WINDOWS\explorer.exe
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2002-09-03 09:00 1004032 a82b28bfc2e4455fe43022a498c0ef0a C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2002-09-03 09:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-04 03:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe
2004-08-04 03:56 110080 77f48ea251a503aae5fc0e7af4a425d7 C:\WINDOWS\system32\services.exe

2002-09-03 09:00 11776 b2b6ba905d0e3f8a32a0eb3b4051807b C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-04 03:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
2004-08-04 03:56 14336 d1320ba74a3866c2859b0518080cf84c C:\WINDOWS\system32\lsass.exe
.
((((((((((((((((((((((((((((( snapshot@2008-06-28_13.07.31.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-28 16:49:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-29 15:25:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 50,736 2006-09-26 00:52:48 C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe
----a-w 48,280 2006-03-10 22:22:57 C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe

----a-w 153,168 2006-11-20 20:42:15 C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe

----a-r 71,216 2006-10-23 12:50:37 C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe

----a-w 49,263 2006-11-09 20:07:30 C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe

----a-w 460,336 2005-10-19 17:13:08 C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe

----a-w 116,272 2005-08-18 21:57:50 C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe

----a-w 992,808 2006-03-07 20:05:20 C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe

----a-w 110,592 2002-08-02 18:41:08 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe

----a-w 98,304 2006-08-28 23:16:07 C:\Program Files\QuickTime\bak\qttask.exe
----a-w 413,696 2008-03-29 03:37:20 C:\Program Files\QuickTime\QTTask.exe

----a-w 26,112 2006-06-21 08:29:38 C:\Program Files\Real\RealPlayer\bak\RealPlay.exe
----a-w 26,112 2007-08-29 23:02:17 C:\Program Files\Real\RealPlayer\realplay.exe

----a-w 114,688 2006-06-20 03:18:53 C:\WINDOWS\system32\bak\hkcmd.exe

----a-w 155,648 2006-06-20 03:19:05 C:\WINDOWS\system32\bak\igfxtray.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ltho"="C:\PROGRA~1\ASEMBL~1\tracert.exe" [ ]
"Jzjirr"="C:\WINDOWS\system32\??pPatch\??ool32.exe" [ ]
"AOL Fast Start"="C:\Program Files\America Online 9.0e\AOL.EXE" [2005-07-12 06:17 50776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"HostManager"="C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe" [2006-03-10 18:22 48280]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [ ]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [ ]
"AOLSPScheduler"="C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe" [2006-11-20 16:42 8784]
"sscRun"="C:\Program Files\Common Files\AOL\1150817884\ee\SSCRun.exe" [ ]
"OASClnt"="C:\Program Files\mcafee.com\antivirus\oasclnt.exe" [ ]
"EmailScan"="C:\Program Files\mcafee.com\antivirus\mcvsescn.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [ ]
"MPFExe"="C:\Program Files\mcafee.com\personal firewall\MPfTray.exe" [ ]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 17:42 79448]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-08-29 19:02 26112]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 19:52 936960]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 15:20 2061816]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"lphcefhj0er0g"="C:\WINDOWS\system32\lphcefhj0er0g.exe" [ ]
"SMrhcafhj0er0g"="C:\Program Files\rhcafhj0er0g\rhcafhj0er0g.exe" [ ]
"sysrest32.exe"="C:\WINDOWS\system32\sysrest32.exe" [ ]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ZyXEL G-220 v2 Wireless Adapter Utility.lnk - C:\Program Files\ZyXEL\ZyXEL G-220 v2 Wireless Adapter Utility\ZyXEL G-220 v2.exe [2007-09-17 16:11:27 10891264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Rcagps"= {609D22F7-CA37-885D-66E6-9C9E79E4944D} - C:\WINDOWS\system32\fyudix.dll [ ]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgm.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgs.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
--a------ 2002-10-03 20:50 684032 C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
--------- 2001-01-03 15:50 66048 C:\WINDOWS\system32\SK9910DM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PROMon.exe]
--a------ 2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2007-08-29 19:02 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0e\\waol.exe"=
"C:\\Program Files\\ZyXEL\\ZyXEL G-220 v2 Wireless Adapter Utility\\ZyXEL G-220 v2.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R2 RioPNP;RioPNP;C:\WINDOWS\system32\drivers\RioPNP.sys [2000-06-06 10:29]
R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;C:\WINDOWS\System32\ZDCNDIS5.sys [2006-08-17 10:03]
R3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanGZXP.sys [2006-08-17 10:03]
S1 seppgm;TCP x IP2 Kernel;C:\WINDOWS\System32\seppgm.sys []
S2 seppgs;TCP x IP2 Kernel32;C:\WINDOWS\System32\seppgm.sys []
S3 {BEE686B9-4C84-4487-9D72-9F40F051E973};{BEE686B9-4C84-4487-9D72-9F40F051E973};C:\WINDOWS\System32\svchost.exe [2008-06-26 05:36]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
{BEE686B9-4C84-4487-9D72-9F40F051E973}

*Newly Created Service* - NMSCFG
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-29 11:26:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{BEE686B9-4C84-4487-9D72-9F40F051E973}]
"ServiceDll"="C:\DOCUME~1\OWNER~1.OLU\LOCALS~1\Temp\25E.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1150817884\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\McShield.exe
C:\Program Files\mcafee.com\personal firewall\MpfService.exe
C:\WINDOWS\system32\NMSSvc.Exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\America Online 9.0e\waol.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\America Online 9.0e\shellmon.exe
.
**************************************************************************
.
Completion time: 2008-06-29 11:44:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-29 15:43:30
ComboFix2.txt 2008-06-28 19:33:29
ComboFix3.txt 2008-06-28 17:10:41

Pre-Run: 11,121,094,656 bytes free
Post-Run: 11,213,611,008 bytes free

268 --- E O F --- 2008-06-20 06:54:47
 
Combofix/CFScript did not remove the AWF infection, we will have to do it manually, the option is to reformat.
http://spyware-free.us/tutorials/reformat/
http://www.cyberwalker.net/faqs/how-tos/reinstall-faq.html
http://helpdesk.its.uiowa.edu/windows/instructions/reformat.htm

Here is the first step:

You have a downloader trojan called Downloader.Agent.awf or Downloader.Agent.ayy. This trojan replaces legitimate files that are common on most computers with an infected file. It then moves the legitimate file to a "bak" or backup folder. Please follow the directions below to run FindAWF so we can identify the files that have been infected and the backups then restore them.
Please download FindAWF and save it to your Desktop

  • * Double-click FindAWF.exe to start the tool.
    * Select option #1 - Scan for bak folders by typing 1 and press 'Enter'
    * When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.

**Do not run any other option unless directed to do so.**
 
Find AWF report by noahdfear ©2006
Version 1.40

The current date is: Tue 07/01/2008
The current time is: 13:59:40.81


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\QUICKT~1\BAK

08/28/2006 07:16 PM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

06/19/2006 11:18 PM 114,688 hkcmd.exe
06/19/2006 11:19 PM 155,648 igfxtray.exe
2 File(s) 270,336 bytes

Directory of C:\PROGRA~1\MCAFEE.COM\ANTIVI~1\BAK

10/19/2005 01:13 PM 460,336 mcvsescn.exe
08/18/2005 05:57 PM 116,272 oasclnt.exe
2 File(s) 576,608 bytes

Directory of C:\PROGRA~1\MCAFEE.COM\PERSON~1\BAK

03/07/2006 04:05 PM 992,808 MPfTray.exe
1 File(s) 992,808 bytes

Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK

08/02/2002 02:41 PM 110,592 mm_tray.exe
1 File(s) 110,592 bytes

Directory of C:\PROGRA~1\REAL\REALPL~1\BAK

06/21/2006 04:29 AM 26,112 RealPlay.exe
1 File(s) 26,112 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\ACS\BAK

10/23/2006 08:50 AM 71,216 AOLDial.exe
1 File(s) 71,216 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~1.0_1\BIN\BAK

11/09/2006 04:07 PM 49,263 jusched.exe
1 File(s) 49,263 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\BAK

09/25/2006 08:52 PM 50,736 AOLSoftware.exe
11/20/2006 04:42 PM 153,168 SSCRun.exe
2 File(s) 203,904 bytes

Directory of C:\PROGRA~1\COMMON~1\AOL\115081~1\EE\SERVICES\SAFETY~2\VER210~1\BAK

0 File(s) 0 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

413696 Mar 28 2008 "C:\Program Files\QuickTime\QTTask.exe"
98304 Aug 28 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
114688 Jul 10 2003 "C:\WINNT\system32\hkcmd.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\bak\hkcmd.exe"
114688 May 14 2002 "C:\WINNT\LastGood\System32\hkcmd.exe"
114688 Jun 19 2006 "C:\CABS\Winxp\Display\82845GGL\hkcmd.exe"
114688 Jun 19 2006 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\hkcmd.exe"
114688 May 14 2002 "C:\WINNT\system32\ReinstallBackups\0007\DriverFiles\hkcmd.exe"
155648 Jul 10 2003 "C:\WINNT\system32\igfxtray.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\bak\igfxtray.exe"
155648 May 14 2002 "C:\WINNT\LastGood\System32\igfxtray.exe"
155648 Jun 19 2006 "C:\CABS\Winxp\Display\82845GGL\igfxtray.exe"
155648 Jun 19 2006 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\igfxtray.exe"
155648 May 14 2002 "C:\WINNT\system32\ReinstallBackups\0007\DriverFiles\igfxtray.exe"
460336 Oct 19 2005 "C:\Program Files\mcafee.com\antivirus\bak\mcvsescn.exe"
116272 Aug 18 2005 "C:\Program Files\mcafee.com\antivirus\bak\oasclnt.exe"
992808 Mar 7 2006 "C:\Program Files\mcafee.com\personal firewall\bak\MPfTray.exe"
110592 Aug 2 2002 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe"
135168 Sep 3 2007 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\ChanDir\MMJB\mm_tray.exe"
26112 Aug 29 2007 "C:\Program Files\Real\RealPlayer\realplay.exe"
26112 Jun 21 2006 "C:\Program Files\Real\RealPlayer\bak\RealPlay.exe"
71216 Oct 23 2006 "C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe"
49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
49263 Nov 9 2006 "C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe"
48280 Mar 10 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\AOLSoftware.exe"
50736 Sep 25 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\bak\AOLSoftware.exe"
153168 Nov 20 2006 "C:\Program Files\Common Files\AOL\1150817884\ee\bak\SSCRun.exe"


end of report
 
Status
Not open for further replies.
Back
Top