32 replies to this topic

[Siggyx]

Try this scanner instead of panda then

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post as well as a bew hijackthis log please.

[mattnixon]

k,trojan-hunter found nothing..took the time to look at my last log to come-up with a few things (log file to follow..humor me) In the running processes I got -"C:\WINDOWS\system32\wuauclt.ext" thats bad huh? virus (w32rbot-qu)?,PLEASE ADVISE...next suspect is-"C:\WINDOWS\system32\alg.exe",seems like a new twist on the virus?,PLEASE ADVISE...totally in the dark on-C:WINDOWS\system32\wdfmgr.exe,PLEASE ADVISE...old friend in (I think the wrong place,would be):C:WINDOWSsystem32\csrss.exe,PLEASE ADVISE...and "04-HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies|ATI Control Panel\atiptaxx.exe (this is RBOT-XP WORM...CORRECT?)and should be deleated?...thanks again, log file:Logfile of HijackThis v1.99.1
Scan saved at 8:23:44 PM, on 2/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\HPConfig.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\wltray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\bma\Desktop\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8l.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\adwarealert.Exe -boot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewid...oOnlineScan.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by17fd.bay17....es/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1136415824363
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/...aploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by107fd.bay10...ex/HMAtchmt.ocx
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

[mattnixon]

K,Siggyx,just got your last post,going to run the Kaspersky will get back asap (unless thats a chess game! {weak joke.exe!})

[Siggyx]

Whoooa. all of those files are ok. You go deleting them and your system will be in trouble. If you ever want to chek on a file you can do a single file scan here >>>> http://virusscan.jotti.org/

Your log does not look to bad at this point. The worst thing I see at the moment is this

AdwareAlert
Command AdwareAlert.Exe
Status X
Description "Spyware remover" of dubious repute - see the SpywareWarrior_List of Rogue/Suspect Anti-Spyware Products & Web Sites

As seen here >>>> http://www.spywarewa...nti-spyware.htm

You should remove that scanner.

How is the system running at the moment?

[mattnixon]

ok..would not touch anything unless an expert told me to...running the kaspersky scan right now...cool site btw,thanks..mmm, are you sure that this is clean?:C:\WINDOWS\system32\wuauclt.exe.?....and shoot, 04-\atiptaxx.exe?.running Kaspersky,all is good with that.thanks, probably won't type to you until tommorrow.thanks again.

[mattnixon]

ok..would not touch anything unless an expert told me to...running the kaspersky scan right now...cool site btw,thanks..mmm, are you sure that this is clean?:C:\WINDOWS\system32\wuauclt.exe.?....and shoot, 04-\atiptaxx.exe?.running Kaspersky,all is good with that.thanks, probably won't type to you until tommorrow.thanks again....and p.s.:thanks for that latest link to look at files..I like to look at that stuff and learn.

[Siggyx]

When we are done I can give you a few more links to check out files etc.... if you want.

[mattnixon]

k,ran the "Kaspersky" overnight:I woke up to 14 viruses in 13,000+ files...not bad eh? Was going to to post the 3.50mb file log but then I got an app. hang between cut and paste and lost that.So this morning ran an "ewido", it detected and cleansed 14 viruses (ooh presto I thought).Then I ran an "AVG" and it came up empty ("nice, even better"I thought).Then at about 2.30pm (it's 6.40pm now) I ran anouther "kaspersky"...just home..TROUBLE! Its still running,about 81% compleate and up to 10 viruses in about 10,000 files (running seqencial viral file #'s in.... C:System Volume Information\_restore...15-ASDC-A445A55876AD}\RP33\A013013.exe)at this point,similar to this mornings log (which had a few .html's spinkled in for good measure now and then).now what should I do?

[mattnixon]

k, this is going to be long and boring,or may shed some insight on my problems...looked back at he results of my "avg" scans and found some interesteing stuff....first one was 1.6.06-in system32 it read "dmgmi.exe" and "hgqhp.exe" as a 'reading error'-you told me on 2-04-06 there both bad (the avg status, as with all 'reading errors'..is that you can't get help)....scan on 1-9-06 was clean except a deleated virus in C:\System Volume Information\-restore{68dcc.....scan on 1-17...again System32(reading error)"dmuiz.exe"|yup I see the dm|....scan on 1-21 contained 'reading error' (in system32),dmefo.exe...scan on 1-23, 'reading error' system32\dmroc.exe......1-26 'reading error',32\dmghb.exe....1-29 'reading error' 32\dmifj.exe....2-6!!!!!!!!!!!!!!!!!!!!!!!!----suddenly this,"C:\Documents and settings\bma\Application Data\Sun\Java....bla,bla JAVA/ByteVerify,infected,embedded object (inside the archive and cannot be healed.

[mattnixon]

seriously.this is getting worse...not better.K, saved the 3.50mb "k" file for you...but for some reason can't get it to you..will you please actually read my blogs/or what-ever there called and read what i say?..I don't think the answers simple but I think it can be resolved if you listen to what i'm saying.(saved the "k" log in my desktop like you asked)and don't get mad at me,I guessI just don't understand why my problems are getting worse and it should be getting better(and I don't expect to push some magic button, but jeez..)..anyway,thanks again...talk to you when your on next...should I just e-mail myself all my important stuff, then restore to factory settings????? at that point ....night and thanks

[mattnixon]

k, almost all of the 3.50mb "Kaspersky" was "trojan-downloader.32.small.bgv"(thier term for it);nearly all of the 13,000+ files.Also had a few others but mostly that one.When I searched them all in Kaspersky the ".small.bvg" was recognized by them in mid-nov. 2005.The newest virus I had was recognized in early December. I had Norton anti-virus 2005 but live updates expired on Dec.31...because it seemed to conflict with "AVG" when I was running a scan I removed it right after the first of the year (bonehead move probably in retrospect,rather than disabling it,but I was starting to have problems around that time though and had this delusion about Symantec sending out viruses to get people to re-up. [phew!]...anyway, I saved the disk and key,and I'm answering my own question...so I'll reinstall it and get back to you.

[Siggyx]

To try and reduce the size of the scan do this

Download ccleaner from the link below, save it to your desktop. Open ccleaner and click on run ccleaner at the bottom right.

http://www.majorgeek...wnload4191.html

Next download Regseeker from the link below. Save it to your destop. Open Regseeker and click on clean registry, next click ok. Once the scan is complete make sure the make backups is checked and then select all and delete it.

http://www.majorgeek...wnload2579.html

I do not normally advise people to clean up thier system restore as having a bad restore point is better than no restore point. But if you want to clean it up

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.


1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives" as shown in this illustration:
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Proceed with what you need to do; for example, virus removal. When you have finished, restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK.

Edited by Siggyx, 08 February 2006 - 05:11 PM.

[mattsandiego]

ok,I'm back on-line at least.Going to run norton anti-v first I suppose.I don't think I messed anything up,that was a little scary though.I'm going out for a beer,I'll let you know how things turn out.Thanks either way,for putting up with me and your time

[mattnixon]

cool!.here's my "Kaspersky" log...(Question follows)------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Thursday, February 09, 2006 05:02:51 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 9/02/2006 Kaspersky Anti-Virus database records: 175756 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 93892 Number of viruses found: 1 Number of infected objects: 29 Number of suspicious objects: 0 Duration of the scan process: 8564 sec Infected Object Name - Virus Name C:\Program Files\Norton AntiVirus\Quarantine\051230C9.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\06482760.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\1CEF0CF7.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\1CF236F4.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\23EA39E4.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\268A502D.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\2DAA18AD.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\33CA23BD.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\33CD4DB9.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\398A14ED.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\3EF5368A.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\3FC5014D.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\416172A4.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\48ED2778.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\490D3B2A.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\4C0A07AF.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\4C0D31AC.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\4D2A0FB8.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\512D2A60.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\564C6A62.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\5BBD136B.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\5E225BE5.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\61005881.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\62601339.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\69A063DF.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\70962BD3.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\73B10479.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\75E37E11.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an C:\Program Files\Norton AntiVirus\Quarantine\7CE97B78.exe Infected: not-a-virus:AdWare.Win32.WebSearch.an Scan process completed. *********************************k, That was also in the previous log.All the others are gone!!(THANKS,SO MUCH)...Is that report saying I have an infection,but it is quarantined?

[Siggyx]

Thats is what it is saying One more hijackthis log please.