[Resolved] Spyware Issues

ajones,

It's interesting that they won't delete. c:\3160a59d7cd17ac74303 was just an empty folder.

Let's see what's there first.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :dir
  C:\9337e65c18ca4b0411e7d09d /s
  C:\3160a59d7cd17ac74303 /s

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Here are its contents:

ajones, Could you read the original text file? If so, could copy/paste the information here?

What exactly do you mean by read?

ajones, I mean, when you look at it, is it comprised of characters that you can recognize as letters and numbers?

Yes, they're both compromised of readable letters and numbers.

ajones, Then please copy/paste the information here.

What exactly do you mean by copy/paste the information? I occasionally don't get simple tasks like this until it's explained, usually thoroughly.

ajones, I mean to post that information here just like you posted the HijackThis log. If you're still confused, don't worry. I can give you step by step instructions.

Still lost.

ajones,

There is a file on your Desktop entitled SystemLook.txt
Double click on it notepad will open. You should be looking at a bunch of letters and numbers.
Click with your mouse anywhere in the Notepad window.
On your keyboard, press the A key while holding the Ctrl key
Everything in the notepad window should become highlighted.
Press the C key while holding the Ctrl key.

Then come back to this thread and click on the Add Reply button.
Click with your mouse anywhere in the reply window.
On your keyboard, press the V key while holding the Ctrl key.
That should past the information from the txt file here so that I will be able to see it when you post your reply.

SystemLook v1.0 by jpshortstuff (02.03.09) Log created at 14:19 on 11/04/2009 by Owner (Administrator - Elevation successful) ========== dir ========== C:\9337e65c18ca4b0411e7d09d - Parameters: "/s" —Files— $shtdwn$.req –ah– 788 bytes [10:02 15/02/2009] [10:02 15/02/2009] batchparser90.dll –a— 127856 bytes [11:09 10/02/2007] [11:09 10/02/2007] dbghelp.dll –a— 1039728 bytes [11:09 10/02/2007] [11:09 10/02/2007] dumpdatastore.dll –a— 1160560 bytes [11:15 10/02/2007] [11:15 10/02/2007] hotfix.exe –a— 2538848 bytes [10:24 18/12/2008] [10:24 18/12/2008] hotfixas.inf –a— 2186 bytes [16:32 18/12/2008] [16:32 18/12/2008] hotfixdts.inf –a— 2718 bytes [16:34 18/12/2008] [16:34 18/12/2008] hotfixns.inf –a— 2434 bytes [16:34 18/12/2008] [16:34 18/12/2008] hotfixrs.inf –a— 5394 bytes [16:36 18/12/2008] [16:36 18/12/2008] hotfixsql.inf –a— 3176 bytes [16:40 18/12/2008] [16:40 18/12/2008] hotfixtools.inf –a— 7728 bytes [16:46 18/12/2008] [16:46 18/12/2008] master.inf –a— 710 bytes [16:31 18/12/2008] [16:31 18/12/2008] msvcp80.dll –a— 548864 bytes [05:26 14/10/2005] [05:26 14/10/2005] msvcr80.dll –a— 626688 bytes [05:26 14/10/2005] [05:26 14/10/2005] sqlcmd.exe –a— 143728 bytes [11:29 10/02/2007] [11:29 10/02/2007] sqlcmd.rll –a— 27504 bytes [11:23 10/02/2007] [11:23 10/02/2007] sqldiscoveryapi.dll –a— 533872 bytes [11:29 10/02/2007] [11:29 10/02/2007] sqlsetupvista.dll –a— 230256 bytes [11:29 10/02/2007] [11:29 10/02/2007] C:\9337e65c18ca4b0411e7d09d\1028 d—– [10:01 15/02/2009] eula.txt –a— 974 bytes [06:02 18/12/2008] [06:02 18/12/2008] finalsql2005information.rtf –a— 1522 bytes [19:09 14/11/2008] [19:09 14/11/2008] hotfix.rll –a— 52576 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 118104 bytes [06:02 18/12/2008] [06:02 18/12/2008] sqlse.rll –a— 60248 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1031 d—– [10:01 15/02/2009] eula.txt –a— 3256 bytes [05:43 18/12/2008] [05:43 18/12/2008] finalsql2005information.rtf –a— 823 bytes [20:55 17/11/2008] [20:55 17/11/2008] hotfix.rll –a— 58200 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 124618 bytes [05:43 18/12/2008] [05:43 18/12/2008] sqlse.rll –a— 72024 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1033 d—– [10:01 15/02/2009] eula.txt –a— 2432 bytes [21:02 17/12/2008] [21:02 17/12/2008] finalsql2005information.rtf –a— 843 bytes [21:02 17/12/2008] [21:02 17/12/2008] hotfix.rll –a— 52576 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 117694 bytes [21:02 17/12/2008] [21:02 17/12/2008] sqlse.rll –a— 60248 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1036 d—– [10:01 15/02/2009] eula.txt –a— 2962 bytes [05:44 18/12/2008] [05:44 18/12/2008] finalsql2005information.rtf –a— 867 bytes [07:46 07/12/2008] [07:46 07/12/2008] hotfix.rll –a— 59736 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 125232 bytes [05:44 18/12/2008] [05:44 18/12/2008] sqlse.rll –a— 72024 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1040 d—– [10:01 15/02/2009] eula.txt –a— 3224 bytes [05:45 18/12/2008] [05:45 18/12/2008] finalsql2005information.rtf –a— 820 bytes [09:19 04/12/2008] [09:19 04/12/2008] hotfix.rll –a— 58200 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 123254 bytes [05:45 18/12/2008] [05:45 18/12/2008] sqlse.rll –a— 70496 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1041 d—– [10:01 15/02/2009] eula.txt –a— 1428 bytes [05:45 18/12/2008] [05:45 18/12/2008] finalsql2005information.rtf –a— 1990 bytes [09:21 04/12/2008] [09:21 04/12/2008] hotfix.rll –a— 52576 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 126746 bytes [05:45 18/12/2008] [05:45 18/12/2008] sqlse.rll –a— 60256 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1042 d—– [10:01 15/02/2009] eula.txt –a— 1530 bytes [21:02 17/12/2008] [21:02 17/12/2008] finalsql2005information.rtf –a— 1760 bytes [09:22 04/12/2008] [09:22 04/12/2008] hotfix.rll –a— 52568 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 120519 bytes [21:02 17/12/2008] [21:02 17/12/2008] sqlse.rll –a— 60248 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1043 d—– [10:01 15/02/2009] eula.txt –a— 2652 bytes [05:45 18/12/2008] [05:45 18/12/2008] finalsql2005information.rtf –a— 981 bytes [05:45 18/12/2008] [05:45 18/12/2008] hotfix.rll –a— 56152 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 117694 bytes [05:45 18/12/2008] [05:45 18/12/2008] sqlse.rll –a— 70488 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1046 d—– [10:01 15/02/2009] eula.txt –a— 2512 bytes [05:45 18/12/2008] [05:45 18/12/2008] finalsql2005information.rtf –a— 1113 bytes [05:45 18/12/2008] [05:45 18/12/2008] hotfix.rll –a— 55640 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 117694 bytes [05:45 18/12/2008] [05:45 18/12/2008] sqlse.rll –a— 65368 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1049 d—– [10:01 15/02/2009] eula.txt –a— 3080 bytes [21:02 17/12/2008] [21:02 17/12/2008] finalsql2005information.rtf –a— 2819 bytes [21:02 17/12/2008] [21:02 17/12/2008] hotfix.rll –a— 57688 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 125736 bytes [21:02 17/12/2008] [21:02 17/12/2008] sqlse.rll –a— 66400 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\1053 d—– [10:01 15/02/2009] eula.txt –a— 2454 bytes [21:02 17/12/2008] [21:02 17/12/2008] finalsql2005information.rtf –a— 1095 bytes [21:02 17/12/2008] [21:02 17/12/2008] hotfix.rll –a— 55128 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 117694 bytes [21:02 17/12/2008] [21:02 17/12/2008] sqlse.rll –a— 62808 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\2052 d—– [10:01 15/02/2009] eula.txt –a— 990 bytes [06:04 18/12/2008] [06:04 18/12/2008] finalsql2005information.rtf –a— 1384 bytes [08:04 16/11/2008] [08:04 16/11/2008] hotfix.rll –a— 52576 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 117738 bytes [06:04 18/12/2008] [06:04 18/12/2008] sqlse.rll –a— 60256 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\3082 d—– [10:01 15/02/2009] eula.txt –a— 2916 bytes [05:47 18/12/2008] [05:47 18/12/2008] finalsql2005information.rtf –a— 859 bytes [18:10 02/12/2008] [18:10 02/12/2008] hotfix.rll –a— 58720 bytes [10:24 18/12/2008] [10:24 18/12/2008] sqlhotfix.chm –a— 124166 bytes [05:47 18/12/2008] [05:47 18/12/2008] sqlse.rll –a— 70496 bytes [10:24 18/12/2008] [10:24 18/12/2008] C:\9337e65c18ca4b0411e7d09d\hotfixas d—– [10:01 15/02/2009] C:\9337e65c18ca4b0411e7d09d\hotfixas\files d—– [10:01 15/02/2009] sqlrun_as.msp –a— 7887872 bytes [16:32 18/12/2008] [16:32 18/12/2008] C:\9337e65c18ca4b0411e7d09d\hotfixdts d—– [10:01 15/02/2009] C:\9337e65c18ca4b0411e7d09d\hotfixdts\files d—– [10:01 15/02/2009] sqlrun_dts.msp –a— 3611648 bytes [16:34 18/12/2008] [16:34 18/12/2008] C:\9337e65c18ca4b0411e7d09d\hotfixns d—– [10:01 15/02/2009] C:\9337e65c18ca4b0411e7d09d\hotfixns\files d—– [10:01 15/02/2009] sqlrun_ns.msp –a— 3358720 bytes [16:34 18/12/2008] [16:34 18/12/2008] C:\9337e65c18ca4b0411e7d09d\hotfixrs d—– [10:01 15/02/2009] C:\9337e65c18ca4b0411e7d09d\hotfixrs\files d—– [10:01 15/02/2009] sqlrun_rs.msp –a— 5616128 bytes [16:36 18/12/2008] [16:36 18/12/2008] C:\9337e65c18ca4b0411e7d09d\hotfixsql d—– [10:01 15/02/2009] C:\9337e65c18ca4b0411e7d09d\hotfixsql\files d—– [10:01 15/02/2009] sqlrun_sql.msp –a— 22111744 bytes [16:40 18/12/2008] [16:40 18/12/2008] C:\9337e65c18ca4b0411e7d09d\hotfixtools d—– [10:01 15/02/2009] C:\9337e65c18ca4b0411e7d09d\hotfixtools\files d—– [10:01 15/02/2009] sqlrun_tools.msp –a— 4249088 bytes [16:46 18/12/2008] [16:46 18/12/2008] C:\3160a59d7cd17ac74303 - Parameters: "/s" —Files— $shtdwn$.req –ah– 788 bytes [09:02 05/04/2009] [09:02 05/04/2009] batchparser90.dll –a— 125280 bytes [04:14 25/11/2008] [04:14 25/11/2008] hotfix.exe –a— 2539872 bytes [04:25 25/11/2008] [04:25 25/11/2008] hotfixexpress.inf –a— 2076 bytes [03:12 26/11/2008] [03:12 26/11/2008] master.inf –a— 534 bytes [03:12 26/11/2008] [03:12 26/11/2008] msvcp80.dll –a— 548864 bytes [04:26 14/10/2005] [04:26 14/10/2005] msvcr80.dll –a— 626688 bytes [04:26 14/10/2005] [04:26 14/10/2005] osql.exe –a— 51552 bytes [04:26 25/11/2008] [04:26 25/11/2008] osql.rll –a— 15064 bytes [07:44 14/10/2005] [07:44 14/10/2005] sqlcmd.exe –a— 141664 bytes [03:31 25/11/2008] [03:31 25/11/2008] sqlcmd.rll –a— 24928 bytes [03:14 25/11/2008] [03:14 25/11/2008] sqldiscoveryapi.dll –a— 530784 bytes [03:31 25/11/2008] [03:31 25/11/2008] sqlsetupvista.dll –a— 227680 bytes [03:31 25/11/2008] [03:31 25/11/2008] C:\3160a59d7cd17ac74303\1033 d—– [09:01 05/04/2009] eula.txt –a— 2432 bytes [23:37 21/11/2008] [23:37 21/11/2008] finalsql2005information.rtf –a— 844 bytes [23:37 21/11/2008] [23:37 21/11/2008] hotfix.rll –a— 53600 bytes [04:25 25/11/2008] [04:25 25/11/2008] sqlhotfix.chm –a— 116106 bytes [23:37 21/11/2008] [23:37 21/11/2008] sqlse.rll –a— 61280 bytes [04:25 25/11/2008] [04:25 25/11/2008] C:\3160a59d7cd17ac74303\hotfixexpress d—– [09:01 05/04/2009] C:\3160a59d7cd17ac74303\hotfixexpress\files d—– [09:01 05/04/2009] sqlexpr.exe –a— 57393504 bytes [21:40 26/11/2008] [21:40 26/11/2008] -=End Of File=-

ajones,

Perfect.

As you suspected, everything in those folders appears to be updates for Microsoft SQL. Let's see if we can remove them.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Processes
  explorer.exe
  
  :Services
  
  :Reg
  
  :Files
  C:\9337e65c18ca4b0411e7d09d
  C:\3160a59d7cd17ac74303
  
  :Commands
  [purity]
  [emptytemp]
  [start explorer]
  [Reboot]

• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixtools\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixtools scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixsql\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixsql scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixrs\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixrs scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixns\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixns scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixdts\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixdts scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixas\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixas scheduled to be moved on reboot. C:\9337e65c18ca4b0411e7d09d\3082 moved successfully. C:\9337e65c18ca4b0411e7d09d\2052 moved successfully. C:\9337e65c18ca4b0411e7d09d\1053 moved successfully. C:\9337e65c18ca4b0411e7d09d\1049 moved successfully. C:\9337e65c18ca4b0411e7d09d\1046 moved successfully. C:\9337e65c18ca4b0411e7d09d\1043 moved successfully. C:\9337e65c18ca4b0411e7d09d\1042 moved successfully. C:\9337e65c18ca4b0411e7d09d\1041 moved successfully. C:\9337e65c18ca4b0411e7d09d\1040 moved successfully. C:\9337e65c18ca4b0411e7d09d\1036 moved successfully. C:\9337e65c18ca4b0411e7d09d\1033 moved successfully. C:\9337e65c18ca4b0411e7d09d\1031 moved successfully. C:\9337e65c18ca4b0411e7d09d\1028 moved successfully. Folder move failed. C:\9337e65c18ca4b0411e7d09d scheduled to be moved on reboot. Folder move failed. C:\3160a59d7cd17ac74303\hotfixexpress\files scheduled to be moved on reboot. Folder move failed. C:\3160a59d7cd17ac74303\hotfixexpress scheduled to be moved on reboot. C:\3160a59d7cd17ac74303\1033 moved successfully. Folder move failed. C:\3160a59d7cd17ac74303 scheduled to be moved on reboot. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\etilqs_yqOEwcjQQQt3npsfczUq scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\~DFD873.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\JET115B.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_430.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_554.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04142009_201952 Files moved on Reboot… Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixtools\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixtools\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixtools scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixsql\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixsql\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixsql scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixrs\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixrs\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixrs scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixns\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixns\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixns scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixdts\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixdts\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixdts scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixas\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixas\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixas scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixtools\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixtools scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixsql\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixsql scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixrs\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixrs scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixns\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixns scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixdts\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixdts scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixas\files scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d\hotfixas scheduled to be moved on reboot. Folder move failed. C:\9337e65c18ca4b0411e7d09d scheduled to be moved on reboot. Folder move failed. C:\3160a59d7cd17ac74303\hotfixexpress\files scheduled to be moved on reboot. Folder move failed. C:\3160a59d7cd17ac74303\hotfixexpress\files scheduled to be moved on reboot. Folder move failed. C:\3160a59d7cd17ac74303\hotfixexpress scheduled to be moved on reboot. Folder move failed. C:\3160a59d7cd17ac74303\hotfixexpress\files scheduled to be moved on reboot. Folder move failed. C:\3160a59d7cd17ac74303\hotfixexpress scheduled to be moved on reboot. Folder move failed. C:\3160a59d7cd17ac74303 scheduled to be moved on reboot. File C:\DOCUME~1\Owner\LOCALS~1\Temp\etilqs_yqOEwcjQQQt3npsfczUq not found! C:\DOCUME~1\Owner\LOCALS~1\Temp\~DFD873.tmp moved successfully. File C:\WINDOWS\temp\JET115B.tmp not found! File C:\WINDOWS\temp\Perflib_Perfdata_430.dat not found! File C:\WINDOWS\temp\Perflib_Perfdata_554.dat not found! C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\urlclassifier3.sqlite moved successfully. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\XUL.mfl moved successfully.

ajones,

Well then, let's nuke it.

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Folders to delete:
C:\9337e65c18ca4b0411e7d09d
C:\3160a59d7cd17ac74303

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

3. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
• On reboot, it will briefly open a black command window on your desktop, this is normal.
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh Hijackthis log .