[Resolved] Vandu virus? :(

Hello

Recently (specifically yesterday) I noticed that my web browser was starting to open up randomly when clicking on programs or folders in C;/ or desktop. I also noticed that occasionally I was also being redirected to sites other than the ones that I was clicking on (sites saying "YOU HAVE A VIRUS, DOWNLOAD THIS ANTI-VIRUS! " or "System Infected!!!" etc.). I've also noticed that my web browser (iexplorer 7) seems to be performing slower as does my computer, although not tremendously slower. My anti-virus CA Anti-Virus 2009 picked up a file "vamodimu.exe" in the C:\WINDOWS\system32 folder and deleted it… I've got the scanner log. I've also downloaded HiJackThis and Spybot Search and Destroy but I have not used them yet as I thought I should wait, to hear somene's advice. Hope someone can help! Thanks

CA Anti-Virus Real-Time Scanner Log

5/14/2009 16:25:36 PM File infection: C:\DOCUME~1\JILLYB~1.000\LOCALS~1\Temp\prun.tmp is Win32/AdClicker.WP trojan. Deleted
5/14/2009 16:25:36 PM File infection: C:\DOCUME~1\JILLYB~1.000\LOCALS~1\Temp\wavvsnet.tmp is Win32/Matcash.FH trojan. Deleted
5/14/2009 16:25:36 PM File infection: C:\DOCUME~1\JILLYB~1.000\LOCALS~1\Temp\prun.tmp is Win32/AdClicker.WP trojan.
5/14/2009 16:25:36 PM File infection: C:\DOCUME~1\JILLYB~1.000\LOCALS~1\Temp\prun.tmp is Win32/AdClicker.WP trojan.
5/14/2009 16:25:36 PM File infection: C:\DOCUME~1\JILLYB~1.000\LOCALS~1\Temp\wavvsnet.tmp is Win32/Matcash.FH trojan.
5/14/2009 16:25:36 PM File infection: C:\DOCUME~1\JILLYB~1.000\LOCALS~1\Temp\wavvsnet.tmp is Win32/Matcash.FH trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\vamodimu.dll is Win32/Vundo.CZC trojan. Deleted
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\pasagami.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\jiyapise.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\jiyapise.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\jiyapise.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\jiyapise.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\pasagami.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\pasagami.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\pasagami.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\WINDOWS\system32\pasagami.dll is Win32/Vundo.CZC trojan.
5/14/2009 16:26:52 PM File infection: C:\DOCUME~1\JILLYB~1.000\LOCALS~1\Temp\mxvspucbcx.tmp is infected with Win32/Alureon virus. Clean failed

CA Anti-Virus On-Demand Scanner Log

Started scanning at 14/05/2009 6:58:33 PM. Engine Ver: 31.6.0. Sig Ver:6504. Sig Date: 13/05/2009. ArcLib Ver: 8.0.1.1.
C:\pagefile.sys - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\00bb93100d17e5d0d29a766c8a5685b9_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\06329efe67445ac78b0243d161d5b18f_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\081f3daf7be5636900e7a4961a61cb5d_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\0d745fb5e11b853e1042ff239357e709_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\0e9ce885c83a7da33eb4efa211a17509_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\1734558468068182e8fc1e5454d9b420_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\173ae23342899ece4ab15abaf6448bb6_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\1a9a1a85ee230bc90db728f470a8c3ec_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\1c1459614627c2da8c609f6c0c100b74_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\1e3f9e29c08dfcfccd384e7d51865e91_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\1eab26c7b7b9e088fd519604d771163b_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\1f11ccf5b6fd4042b48b186cff68338c_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\20261fa63320b5a583bb83aa77f4014c_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\2036cb325eced9411782f2102e0f237e_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\219d2b06a42d1ddcece0ff59101b249d_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\21d8d476d2aa5503f94283222d34bd71_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\226e626dbe8e98a3d8d42624c1560cfc_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\24b77d631c7d54ab228a11ecee46c443_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\26b382f40d1ea05adf9d9927c96f7b7d_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\2879b6e094492df9608fa5d3d844d198_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\291f479d37c5e8fa1f4b684afcc19c1d_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\2aeba8dde02381b319bb846accb7540b_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\2ca34e039336a8d24df745df30624137_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\3256cb6d7ba97ccacfaeda1cad8aebaa_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\35317ef837d89fd130597f4a5c9b889e_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\355fbf58d99952915d97dff9266357b6_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\362780821296ab6b7bd3405db889f7d1_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\365ebaac217ce2651499f194912c0b48_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\3c5a7462c1690b25567093b8681ffd64_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\3e04ba3cc1571c7990aaa037ba1ca190_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\3e1e2844a805f74af6780be3c4181e4b_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ea1f96076cdf129c2e939c6387b0203_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\3fb82e40ffb9ee7491c8b97c8ae0c6a8_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\43295116ac06761d2c4c049960150ef2_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\496ef7f6461fd344ab1c66e10ebaeea2_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\49902192ff4aea961851130f27709b9b_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\4b2883b2b37b951cf1af6b212fdc0dff_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\4d1c34d5c2d7d0a8eac14cf0e8be42f3_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\4eb2adb15cb8c5d5ef3dcd7e06b25f5c_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\4f597e985362d69445d12a2bb7869ad4_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\506c6eb94a7ee69efa7982805b3fb955_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\509e1f433ac63ea15a644b25f96d8e61_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\51fae83d003161966938e2291629b376_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\532b8f3670c98a365adeb526412da2f7_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\594e9c19ec72061eda228cffc3ea0bd5_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\5c285286042beb6147b223a9721c21cd_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\5cb2594e223b567625eda3e9d3827718_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\5d17490bf35fec0b53962444788422a0_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\6092747403b26e38646e9d21693b3e08_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\682219b7e42f5592fe4145a91df3aaef_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\6d68904da8a8f3a87d80690b74a0c790_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\82594d977339783d277ad20489ad0397_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\83f980aa16f517266e1fee125922c004_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\843e37e4f563d870f7ae1eedd9b4d768_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\878e3b6e34ef623138ce0514fc150c46_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\87c8d530111ed49103cd695b4a7653d3_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\886887f11befe6beeb1eb8f7958bcb3b_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\8cf7acc8c1126f255420036762fc3f88_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\8f815987cc1bea9d078552e0030b4a84_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\976bf440f0402db43ae1ae1319a19091_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\98143e94e57d6ed5fe07612bc6cc9a94_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\9aa495072066e8763a9d8f4a9f614137_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\9aa552c51de1f9b609092dcaabcc0854_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\9bcca38deed23bfdea0d08f652b9f060_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\9d3568c550afe2cb35df249717aa08b6_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\9dcb40b3dfbec37d3012da8ddb77758c_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\9fb6bf9e3d3de1212ce70b54bb3ff006_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\a36db9ebad77e6bcabe247f2180f9eda_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\a3e38292b6d727903d614bc30224fe58_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\a7149578dbcc4605e3fd0515f9fae929_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\a75be52e1fb4c87d0cb56c0edbb81932_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\a7fca6d38685c84abe886b60b5ebaa6d_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\aa7f39a90427da8d602a4a1619144520_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\acf2b05b44c4ea8909a9a84bc62666e9_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\adebfdf5bea1093dfaa278fb86ed37e7_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\aec6be04b3537bff319d79bee7390c91_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\b00387eb43c3d87fcf7d55dd9b08a63f_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\b8137ffc4439c0d01c9bf7b1940263a2_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\b84b5abd7454421fe4d78795f075b8e3_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\b97d48e8d5866d9517a7088fdfda0c1c_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\bbbe8081390204473debe943d8088c3a_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\bfa6402e6a87b094d6ba164673955089_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\c0ae313ab96d51fe361b9c0320dbed86_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\c857c3b40268630f35fba1487bd7a1e0_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\cb12d5034570bdb1610ffe9a11e69669_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\cda68bec96fb4c19ae4a34b3639724ca_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\ce4e4373d098ad893d83ce12cbd31300_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\cefeffae181d37d4731d9e0b85c48e17_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\d060a2a3d1336d0b6f734118a1fefd72_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\d0d7101e6f4625539d546fa4e5244493_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\d13efc30140ec0f326983d43ef07df6b_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\d49862bc495679339adc78b9411328f7_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\d6a34c41d22491cf34490a04fe0177e5_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\d7df6cb3bed78993384fe06e03f5ff69_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\db1bc7a9b99f54375f72f2dcf31175b6_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\db9ecaa68848e961957761443320e0e0_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\dc0d67dd865ee04385c0d2cdfd3ae394_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\ddc0fbf2b6f906a936d470f56bb37564_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\e25c49739ff33b25f90d04772c98dd7f_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\e344dfd1b95e2d47629c75d51d121c4f_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\e383ff8991384676a31d2936f48dd4d1_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\e3f159433653bbd37f2d03751639e454_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\e98623e524087690847dfcd470ea52e5_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\ec9c395eef0667f2ef79cbf5a9ac6795_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\ed9d8a971e783cf4386a3dcabb7f65f1_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\f15379e5eaf83e37ca27786e80157a15_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\f16a3a62f7028e5e07884d4ad078f3e8_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\f1dc4cfe2439b86b582aa01ced044d77_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\f4e4d8317e7d58feac02e49c93d0a1d1_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\f82f2e464d69ed1496c4ea752adf1e46_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\fa3afcddb5716643d5ffd7693f6b821d_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\fc6175a8e687c88b515f22dbafe55723_040e31b4-73a0-4308-8cda-ff563b5fc97b - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\NTUSER.DAT - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\ntuser.dat.LOG - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{98EB434C-689A-0BD4-421D-D9032E2BE3E7}\01\10-{98~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{98EB434C-689A-0BD4-421D-D9032E2BE3E7}\11\11-{F9~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\01\11-{54~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\01\188-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\04\190-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\06\189-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\07\191-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\08\192-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\09\193-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\10\194-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\11\195-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\12\196-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\13\197-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\14\198-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\17\199-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\23\201-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\24\200-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\25\202-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\26\203-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\27\205-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\28\204-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\29\206-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\30\207-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\31\208-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\32\211-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\33\209-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\34\210-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\35\212-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\36\213-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\37\214-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\38\216-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\39\215-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\41\217-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\43\218-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\44\55-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\45\57-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\46\75-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\47\78-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\48\77-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\49\97-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\50\219-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\50\98-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\51\99-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\52\100-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\53\102-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\53\220-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\54\103-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\55\221-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\56\105-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\56\223-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\57\224-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\58\115-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\58\222-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\59\116-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\59\225-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\60\118-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\60\226-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\61\119-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\61\227-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\62\120-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\62\228-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\63\121-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\64\122-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\65\140-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\66\142-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\67\144-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\67\229-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\68\145-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\69\146-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\70\148-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\71\147-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\71\231-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\72\149-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\73\151-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\74\152-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\75\230-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\76\154-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\76\233-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\77\232-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\78\234-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\79\163-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\79\235-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\80\164-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\81\165-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\82\166-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\83\169-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\84\168-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\85\170-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\86\172-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\87\173-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\88\174-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\89\180-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\90\182-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\91\181-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\92\183-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\93\184-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\94\185-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\95\186-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{541CFE73-F1F4-E6D9-C78D-506B7D29480B}\96\187-{A~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{B9F15A53-F514-44AF-4D99-943DDE08F9CD}\01\10-{B9~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{B9F15A53-F514-44AF-4D99-943DDE08F9CD}\15\15-{30~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{201AB3DC-88D4-CD33-EC72-8F28BDCA9D72}\01\10-{20~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{201AB3DC-88D4-CD33-EC72-8F28BDCA9D72}\57\757-{0~2.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{201AB3DC-88D4-CD33-EC72-8F28BDCA9D72}\57\757-{0~2.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{201AB3DC-88D4-CD33-EC72-8F28BDCA9D72}\57\757-{0~2.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{50E5BD07-B1E0-7FF3-9D9A-67D72A2BE72E}\01\11-{50~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{50E5BD07-B1E0-7FF3-9D9A-67D72A2BE72E}\12\12-{92~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{50E5BD07-B1E0-7FF3-9D9A-67D72A2BE72E}\12\12-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{50E5BD07-B1E0-7FF3-9D9A-67D72A2BE72E}\12\12-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{50E5BD07-B1E0-7FF3-9D9A-67D72A2BE72E}\23\25-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{50E5BD07-B1E0-7FF3-9D9A-67D72A2BE72E}\23\25-{AF~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - Could not open the file.
C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - Could not open the file.
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT - Could not open the file.
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG - Could not open the file.
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - Could not open the file.
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - Could not open the file.
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT - Could not open the file.
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG - Could not open the file.
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - Could not open the file.
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - Could not open the file.
C:\WINDOWS\SYSTEM32\config\default - Could not open the file.
C:\WINDOWS\SYSTEM32\config\default.LOG - Could not open the file.
C:\WINDOWS\SYSTEM32\config\SAM - Could not open the file.
C:\WINDOWS\SYSTEM32\config\SAM.LOG - Could not open the file.
C:\WINDOWS\SYSTEM32\config\SECURITY - Could not open the file.
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG - Could not open the file.
C:\WINDOWS\SYSTEM32\config\software - Could not open the file.
C:\WINDOWS\SYSTEM32\config\software.LOG - Could not open the file.
C:\WINDOWS\SYSTEM32\config\system - Could not open the file.
C:\WINDOWS\SYSTEM32\config\system.LOG - Could not open the file.

Files Scanned: 268626
Files Infected: 0
Files Cleaned \ Deleted: 0
Files Quarantined: 0
Memory Infections: 0
Memory Infections Cleaned: 0
Boot Infections: 0
Boot Infections Cleaned: 0


Files not Cleaned\Deleted\Quarantined (Limit 100): 0

Finished scanning at 14/05/2009 7:26:28 PM.


Here is CA Anti-Spyware On-Demand Scanner Log

14/05/2009-6:00:51 PM , Detected , FakeAlert ACO , Trojan , Key "hkey_users \S-1-5-18\software" value "2a422c91-6984-47e4-94be-04c4fad5f8d8" , -1
14/05/2009-6:00:53 PM , Detected , AntiSpyware 2008 , Rogue Security Software , Key "hkey_users \S-1-5-21-1801674531-2049760794-839522115-1105\software\microsoft" value "winid" , -1
14/05/2009-6:00:53 PM , Detected , AntiSpyware 2008 , Rogue Security Software , Key "hkey_users \S-1-5-18\software\microsoft" value "winid" , -1
14/05/2009-6:00:53 PM , Detected , FakeAlert ACO , Trojan , Key "hkey_users \S-1-5-18\software" value "1099ce4a-ff51-4a8d-ab3c-c74b9c06e46f" , -1
14/05/2009-6:00:53 PM , Detected , Disable Task Manager Reg Entry , Annoyance , Key "hkey_users \S-1-5-18\software\microsoft\windows\currentversion\policies\system" value "disabletaskmgr" data "1" , -1
14/05/2009-6:00:53 PM , Detected , cpxinteractive.com , Tracking Cookie , Cookie "[removed][2].txt" File "C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\cookies\[removed][2].txt" , -1374667437
14/05/2009-6:00:53 PM , Detected , Advertising.com , Tracking Cookie , Cookie "jilly@advertising[2].txt" File "C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\cookies\jilly@advertising[2].txt" , -953415486
14/05/2009-6:00:53 PM , Detected , Tacoda cookie , Tracking Cookie , Cookie "jilly@tacoda[2].txt" File "C:\Documents and Settings\jilly.BLUE_MOUNTAINS.000\cookies\jilly@tacoda[2].txt" , 1220417926
14/05/2009-6:00:55 PM , Detected , FakeAlert ACO , Trojan , File "c:\windows\system32\uniq.tll" , 112844655
14/05/2009-6:00:55 PM , Detected , FakeAlert ACO , Trojan , File "c:\windows\system32\warning.gif" , 1950619168
14/05/2009-6:00:56 PM , Detected , FakeAlert ACO , Trojan , File "c:\windows\system32\ahtn.htm" , 723015253

Sorry for posting alot in the one post, I just wanted to make sure I give as much information as possible.

Thanks
Daniel.

–EDIT–

Just thought I'd include a HiJackThis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:53:40 PM, on 15/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\userinit.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\CA\CA Internet Security Suite\ccupdate\CCUpdate.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-au\msntb.dll
O2 - BHO: (no name) - {edd1d8a2-f2d9-4b32-a5d7-b1141004310a} - C:\WINDOWS\system32\jiyapise.dll (file missing)
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-au\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe"
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…AU_ZNxmk311CGAU
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…tup1.0.0.15.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120882983921
O16 - DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC} -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Blue_Mountains
O17 - HKLM\Software\..\Telephony: DomainName = Blue_Mountains
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Blue_Mountains
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Blue_Mountains
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O20 - AppInit_DLLs: C:\WINDOWS\system32\pasagami.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

–
End of file - 9766 bytes

Thanks and regards
Daniel

Wow, thankyou so much! It seems to already be running faster. I haven't yet had any popups either! I'll post the log file.

ComboFix 09-05-14.06 - jilly 15/05/2009 22:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1157 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: CA Anti-Virus *On-access scanning disabled* (Updated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\JILLYB~1.000\LOCALS~1\Temp\mousehook.dll
c:\windows\cdmxtras
c:\windows\Fonts\acrsecB.fon
c:\windows\Fonts\acrsecI.fon
c:\windows\system32\drivers\ovfsthdqioethxwbdwgotxvkbgixcqjwcryrck.sys
c:\windows\system32\ovfsthebqsffpjpcyapbeuryybgrgtehhmlwsx.dll
c:\windows\system32\ovfsthkmrnqyhqmfelrjthtnhrqtfqtveuhiny.dll
c:\windows\system32\ovfsthkvnkrhpyrvjytmipfakrlsrkjgiyxkks.dat
c:\windows\system32\ovfsthnspysblxvtotnuofsiikndelglgvdtun.dat
c:\windows\system32\ovfsthsoboexrqxrqjqdpheyurwdwwcixmybvd.dll
c:\windows\system32\win32hlp.cnf
c:\windows\TEMP\ntdll64.dll

Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\system32\init32.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_ovfsthulrmtasfloymupqobwuhbadiqxdqjkll


((((((((((((((((((((((((( Files Created from 2009-04-15 to 2009-05-15 )))))))))))))))))))))))))))))))
.

2020-02-19 12:06 . 2009-01-19 00:15 ——– d—–w c:\windows\system32\Adobe
2020-02-19 12:06 . 2007-10-14 20:18 ——– d—–w c:\program files\Common Files\Adobe
2020-02-19 09:44 . 2006-12-06 01:49 ——– d—–w C:\Bin
2020-02-19 09:38 . 2020-02-19 09:38 222390 —-a-w C:\IOW32.SYS
2020-02-19 09:26 . 2004-12-27 05:52 ——– d—–w c:\program files\PowerArchiver
2020-02-19 09:19 . 2004-12-31 13:08 ——– d—–w c:\windows\forms
2020-02-19 09:19 . 2007-06-15 01:50 ——– d—–w c:\program files\Windows Messaging
2020-02-19 09:08 . 2020-02-19 09:08 ——– d—–w C:\MSKIDS
2020-02-19 09:06 . 2005-10-28 08:11 ——– d—–w C:\Sega
2020-02-19 08:20 . 2009-05-13 07:16 ——– d–h–w c:\program files\InstallShield Installation Information
2020-02-19 03:57 . 2005-10-15 11:11 ——– d—–w c:\program files\Electronic Arts
2020-02-19 03:52 . 2008-11-26 12:10 ——– d—–w c:\program files\Maxis
2020-02-19 03:05 . 2020-02-19 03:05 ——– d—–w c:\program files\Bullfrog
2020-02-19 02:16 . 2001-10-30 07:01 272054 –sha-w C:\SCDOS.SYS
2020-02-19 02:16 . 2001-08-28 10:51 32768 –sha-w C:\SYSIOMGR.SYS
2020-02-19 01:36 . 2020-02-19 01:36 ——– d-sh–w C:\RECYCLED
2020-02-19 01:32 . 2009-05-13 07:15 ——– d-sh–w c:\windows\Installer
2020-02-19 01:31 . 2005-06-30 01:24 ——– d—–w c:\program files\Common Files\InstallShield
2020-02-19 01:29 . 2020-02-19 01:29 ——– d—–w c:\windows\Local Settings
2020-02-19 01:29 . 2020-02-19 01:29 ——– d–h–w c:\windows\PrintHood
2020-02-19 01:21 . 2020-02-19 01:21 ——– d–h–w c:\windows\NetHood
2020-02-19 01:20 . 2020-02-19 01:20 ——– d—–w c:\windows\system\CatRoot
2020-02-19 01:20 . 2020-02-19 01:20 ——– d-s—w c:\windows\Cookies
2020-02-19 01:20 . 2020-02-19 01:20 ——– d—–w c:\program files\DirectX
2020-02-19 01:19 . 2020-02-19 01:19 ——– d-s—w c:\windows\Favorites
2020-02-19 01:19 . 2009-05-09 13:37 ——– d-s—w c:\windows\Downloaded Program Files
2020-02-19 01:18 . 2020-02-19 01:18 ——– d–h–w c:\windows\Recent
2020-02-19 01:18 . 2004-12-31 13:08 ——– d—–w c:\windows\SendTo
2020-02-19 01:18 . 2020-02-19 01:18 ——– d—–w c:\windows\Start Menu
2020-02-19 01:17 . 2020-02-19 01:17 ——– d—–w c:\windows\Desktop
2020-02-19 01:17 . 2020-02-19 01:17 ——– d—–w c:\windows\All Users

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-02-19 01:19 . 2020-02-19 01:19 266 –sh–w c:\program files\desktop.ini
2020-02-19 01:19 . 2020-02-19 01:19 11079 —ha-w c:\program files\folder.htt
2019-02-20 01:10 . 2019-02-20 01:10 5166 –sh–w C:\SUHDLOG.DAT
2019-02-20 00:54 . 2019-02-20 00:54 ——– d—–w c:\program files\PLUS!
2019-02-20 00:54 . 2019-02-20 00:54 ——– d—–w c:\program files\CHAT
2019-02-20 00:54 . 2019-02-20 00:54 ——– d—–r c:\program files\Accessories
2009-05-15 12:45 . 2009-05-14 10:00 3218 —-a-w c:\windows\system32\PerfStringBackup.TMP
2009-05-15 01:04 . 2009-05-15 01:04 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-05-14 14:51 . 2009-05-14 14:51 ——– d—–w c:\program files\Trend Micro
2009-05-13 07:15 . 2009-05-13 07:15 ——– d—–w c:\program files\NETGEAR
2009-05-12 06:01 . 2009-05-12 06:01 ——– d—–w c:\program files\VistaCodecPack
2009-05-11 11:11 . 2005-01-04 12:35 ——– d—–w c:\program files\Microsoft IntelliType Pro
2009-05-11 10:47 . 2009-05-11 10:47 ——– d—–w c:\program files\Realtek Sound Manager
2009-05-11 10:47 . 2004-12-16 19:57 ——– d—–w c:\program files\AvRack
2009-05-11 10:47 . 2009-05-11 10:47 ——– d—–w c:\program files\Realtek AC97
2009-05-11 10:39 . 2009-05-11 10:39 ——– d—–w c:\program files\CPUID
2009-05-09 04:54 . 2007-05-21 10:21 ——– d—–w c:\program files\EPSON
2009-05-09 04:51 . 2008-06-09 03:37 ——– d—–w c:\program files\AMUST
2009-05-09 04:43 . 2004-11-26 10:55 ——– d—–w c:\program files\MSN Messenger
2009-05-09 04:24 . 2004-12-31 02:48 22720 —-a-w c:\windows\system32\emptyregdb.dat
2009-05-09 04:23 . 2006-12-14 05:53 ——– d—–w c:\program files\Windows Media Connect 2
2009-05-03 16:37 . 2009-05-03 16:37 85504 —-a-w c:\windows\system32\ff_vfw.dll
2009-04-22 10:59 . 2009-04-22 10:59 1033728 —-a-w c:\windows\system32\VSFilter.dll
2009-03-29 15:57 . 2009-03-29 15:57 62149 —-a-w c:\windows\system32\pthreadGC2.dll
2009-03-26 15:16 . 2009-05-11 10:39 12672 —-a-w c:\windows\system32\drivers\cpuz132_x32.sys
2009-03-06 13:49 . 2008-04-14 04:42 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2008-12-20 22:15 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2009-01-08 19:20 78336 —-a-w c:\windows\system32\ieencode.dll
2005-04-05 09:27 . 2005-04-05 09:27 10493 ——w c:\program files\Chefs
.

——- Sigcheck ——-

[-] 2005-05-25 19:07 359936 63FDFEA54EB53DE2D863EE454937CE1E c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2009-01-08 20:12 361600 5AE1C2695F6523AD98B948F2887D8C5E c:\windows\SYSTEM32\DRIVERS\tcpip.sys

[-] 2009-01-08 19:41 1614848 362BC5AF8EAF712832C58CC13AE05750 c:\windows\SYSTEM32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 68856]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-09-04 95536]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-10 40048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-01-27 181488]
"CAVRID"="c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-09-10 234736]
"QOELOADER"="c:\program files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe" [2008-06-06 14088]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2007-09-04 54576]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-08-02 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
NETGEAR WG311v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG311v3\wlancfg5.exe [2006-1-26 1486848]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RegCompact]
2008-04-16 04:24 165368 —-a-w c:\windows\SYSTEM32\RegCompact.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0pgdfgsvc C 1

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\MyWebSearch Email Plugin.lnk
backup=c:\windows\pss\MyWebSearch Email Plugin.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^jilly.BLUE_MOUNTAINS^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\jilly.BLUE_MOUNTAINS\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^jilly.BLUE_MOUNTAINS^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\jilly.BLUE_MOUNTAINS\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\DOOM Collector's Edition\\Final Doom\\Doom95.exe"=
"%windir%\\system32\\ccapp.exe"=
"c:\\Program Files\\Black Isle\\BGII - SoA\\BGMain.exe"=
"c:\\Program Files\\Lionhead Studios Ltd\\Black & White\\runblack.exe"=
"c:\\SIERRA\\Half-Life\\hl.exe"=
"c:\\SIERRA\\Counter-Strike\\cstrike.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\Program Files\\Sierra On-Line\\SIGSPat.exe"=
"c:\\Program Files\\Steam\\SteamApps\\phunky_jill\\half-life deathmatch source\\hl2.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CA\\CA Internet Security Suite\\CA Anti-Virus\\vetmsg.exe"=

R3 PPCtlPriv;PPCtlPriv;c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [6/06/2008 6:39 PM 185584]
S3 cpuz132;cpuz132;c:\windows\SYSTEM32\DRIVERS\cpuz132_x32.sys [11/05/2009 8:39 PM 12672]
.
Contents of the 'Scheduled Tasks' folder

2007-10-26 c:\windows\Tasks\04 Dashboard Confessional-Hands Down.job
- c:\documents and settings\jilly.BLUE_MOUNTAINS.000\Shared\Dashboard Confessional\Unknown Album\04 Dashboard Confessional-Hands Down.mp3 [2007-01-18 06:51 . 2007-01-18 06:54]

2008-10-05 c:\windows\Tasks\CAAntiSpywareScan_Daily as jilly at 6 39 PM.job
- c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe [2008-06-06 11:47]

2007-10-26 c:\windows\Tasks\I love you.job
- c:\documents and settings\jilly.BLUE_MOUNTAINS.000\Desktop\I love you.mht [2007-10-26 00:03]
.
- - - - ORPHANS REMOVED - - - -

BHO-{edd1d8a2-f2d9-4b32-a5d7-b1141004310a} - c:\windows\system32\jiyapise.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.au/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…AU_ZNxmk311CGAU
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\VetRedir.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-15 22:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\MrvGINA.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll
c:\windows\system32\RegCompact.dll

- - - - - - - > 'Explorer.exe'(3068)
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\windows\system32\msi.dll
c:\windows\system32\mshtml.dll
.
———————— Other Running Processes ————————
.
c:\windows\SYSTEM32\savedump.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
c:\program files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\cappactiveprotection.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\CA\CA Internet Security Suite\ccprovsp.exe
c:\program files\MSN Messenger\usnsvc.exe
c:\windows\SYSTEM32\imapi.exe
.
**************************************************************************
.
Completion time: 2009-05-15 22:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-15 12:52

Pre-Run: 249,427,029,504 bytes free
Post-Run: 249,633,724,416 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

245

I'm not sure if everything is cleared up? I'll keep checking to see if anything occurs (popups, slowdown in performances). Thank you so much!

Regards
Daniel

Hello, thanks for your prompt reply!

Ok, i've done what you asked and here are the logs:

MBAM log:

Malwarebytes' Anti-Malware 1.36
Database version: 2138
Windows 5.1.2600 Service Pack 3

16/05/2009 10:25:58 AM
mbam-log-2009-05-16 (10-25-58).txt

Scan type: Quick Scan
Objects scanned: 116481
Time elapsed: 2 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/publisher,version=0.2.0 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/updater,version=0.2.0 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\SYSTEM32\ustart.exe (Adware.Agent) -> Quarantined and deleted successfully.



———————————————————————


Kaspersky Report:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Saturday, May 16, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Saturday, May 16, 2009 02:26:28
Records in database: 2184046
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: Infected:

Scan area - My Computer:
A:\
C:\
D:\
E:\

Suspicious: :
Files scanned: 113550
Threat name: 9
Infected objects: 13
Suspicious objects: 1
Duration of the scan: 04:01:41


File name / Threat name / Threats count
C:\Documents and Settings\jilly\Local Settings\Application Data\Identities\{B076055B-E877-4EDF-95F0-7E8268D06877}\Microsoft\Outlook Express\Copy of Inbox.db Suspicious: Exploit.HTML.Iframe.FileDownload 1
C:\Documents and Settings\jilly\Local Settings\Application Data\Identities\{B076055B-E877-4EDF-95F0-7E8268D06877}\Microsoft\Outlook Express\Copy of Inbox.db Infected: Email-Worm.Win32.Klez.h 1
C:\Program Files\MyEmoticons\My.Emo Infected: not-a-virus:AdWare.Win32.Agent.lxc 1
C:\Program Files\MyEmoticons\MyEmoticons_WhenUSaveNow_InstallerInst.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1
C:\Program Files\MyEmoticons\uninstall.exe Infected: not-a-virus:AdWare.Win32.Agent.lxc 1
C:\Qoobox\Quarantine\C\DOCUME~1\JILLYB~1.000\LOCALS~1\Temp\mousehook.dll.vir Infected: Trojan-Dropper.Win32.Agent.aozs 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\ovfsthdqioethxwbdwgotxvkbgixcqjwcryrck.sys.vir Infected: Trojan.Win32.Tdss.aalf 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthebqsffpjpcyapbeuryybgrgtehhmlwsx.dll.vir Infected: Trojan.Win32.Tdss.aalg 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthkmrnqyhqmfelrjthtnhrqtfqtveuhiny.dll.vir Infected: Trojan.Win32.Tdss.aald 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthsoboexrqxrqjqdpheyurwdwwcixmybvd.dll.vir Infected: Trojan.Win32.Tdss.aalc 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\userinit.exe.vir Infected: Trojan-Dropper.Win32.Agent.aozs 1
C:\Qoobox\Quarantine\C\WINDOWS\TEMP\ntdll64.dll.vir Infected: Trojan-Dropper.Win32.Agent.aozs 1
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\STI3KHM7\lsp[1].exe Infected: Trojan-Dropper.Win32.Agent.aozs 1
C:\WINDOWS\SYSTEM32\dllcache\userinit.exe Infected: Trojan-Dropper.Win32.Agent.aozs 1

The selected area was scanned.


Thanks and regards,
Daniel

Hi,

I deleted combofix on my desktop and downloaded another copy from the link you provided. Here is the log

ComboFix 09-05-17.03 - jilly 18/05/2009 7:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1064 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: CA Anti-Virus *On-access scanning disabled* (Updated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycled\DC12\AWE Control.lnk
c:\recycled\DC12\Creative CD.lnk
c:\recycled\DC12\Creative MIDI Instrument Mapper.lnk
c:\recycled\DC12\Creative MIDI.lnk
c:\recycled\DC12\Creative Mixer.lnk
c:\recycled\DC12\Creative Remote.lnk
c:\recycled\DC12\Creative Wave.lnk
c:\recycled\DC12\Creative WaveSynth-WG.lnk
c:\recycled\DC12\How to use SoundFont.lnk
c:\recycled\DC12\Readme.lnk
c:\recycled\DC12\Singing Text.lnk
c:\recycled\DC12\Soundo'LE.lnk
c:\recycled\DC12\TA Common Questions and Answers.lnk
c:\recycled\DC12\TA Control Panel.lnk
c:\recycled\DC12\TextAssist Dictionary.lnk
c:\recycled\DC12\TextAssist Readme.lnk
c:\recycled\DC12\Texto'LE.lnk
c:\recycled\DC12\TextReader.lnk
c:\recycled\DC12\User's Guide.lnk
c:\recycled\DC12\Vienna 2.1.lnk
c:\recycled\DC12\VoiceAssist.lnk
c:\recycled\DC12\Wave Studio.lnk
c:\recycled\DC13.DRV
c:\recycled\DC15.INF
c:\recycled\DC16.PNF
c:\recycled\DC17.CAT
c:\recycled\DC18.DRV
c:\recycled\DC19.001
c:\recycled\DC2.CFG
c:\recycled\DC20.BXK
c:\recycled\DC22.VXD
c:\recycled\DC23.DRV
c:\recycled\DC26.LGC
c:\recycled\DC27.LGC
c:\recycled\DC28.LGC
c:\recycled\DC29.LGC
c:\recycled\DC3.DLL
c:\recycled\DC30.LGC
c:\recycled\DC31.INF
c:\recycled\DC32.DLL
c:\recycled\DC33.ACM
c:\recycled\DC34.DLL
c:\recycled\DC35.DLL
c:\recycled\DC36.DLL
c:\recycled\DC37.DRV
c:\recycled\DC38.DRV
c:\recycled\DC39.ACM
c:\recycled\DC4.DLL
c:\recycled\DC40.LNK
c:\recycled\DC41.LNK
c:\recycled\DC42.LNK
c:\recycled\DC43.LNK
c:\recycled\DC5.DLL
c:\recycled\DC6.DLL
c:\recycled\DC7.INI
c:\recycled\INFO2

.
((((((((((((((((((((((((( Files Created from 2009-04-17 to 2009-05-17 )))))))))))))))))))))))))))))))
.

2020-02-19 12:06 . 2009-01-19 00:15 ——– d—–w c:\windows\system32\Adobe
2020-02-19 12:06 . 2007-10-14 20:18 ——– d—–w c:\program files\Common Files\Adobe
2020-02-19 09:44 . 2006-12-06 01:49 ——– d—–w C:\Bin
2020-02-19 09:38 . 2020-02-19 09:38 222390 —-a-w C:\IOW32.SYS
2020-02-19 09:26 . 2004-12-27 05:52 ——– d—–w c:\program files\PowerArchiver
2020-02-19 09:19 . 2004-12-31 13:08 ——– d—–w c:\windows\forms
2020-02-19 09:19 . 2007-06-15 01:50 ——– d—–w c:\program files\Windows Messaging
2020-02-19 09:08 . 2020-02-19 09:08 ——– d—–w C:\MSKIDS
2020-02-19 09:06 . 2005-10-28 08:11 ——– d—–w C:\Sega
2020-02-19 08:20 . 2009-05-13 07:16 ——– d–h–w c:\program files\InstallShield Installation Information
2020-02-19 03:57 . 2005-10-15 11:11 ——– d—–w c:\program files\Electronic Arts
2020-02-19 03:52 . 2008-11-26 12:10 ——– d—–w c:\program files\Maxis
2020-02-19 03:05 . 2020-02-19 03:05 ——– d—–w c:\program files\Bullfrog
2020-02-19 02:16 . 2001-10-30 07:01 272054 –sha-w C:\SCDOS.SYS
2020-02-19 02:16 . 2001-08-28 10:51 32768 –sha-w C:\SYSIOMGR.SYS
2020-02-19 01:32 . 2009-05-13 07:15 ——– d-sh–w c:\windows\Installer
2020-02-19 01:31 . 2005-06-30 01:24 ——– d—–w c:\program files\Common Files\InstallShield
2020-02-19 01:29 . 2020-02-19 01:29 ——– d—–w c:\windows\Local Settings
2020-02-19 01:29 . 2020-02-19 01:29 ——– d–h–w c:\windows\PrintHood
2020-02-19 01:21 . 2020-02-19 01:21 ——– d–h–w c:\windows\NetHood
2020-02-19 01:20 . 2020-02-19 01:20 ——– d—–w c:\windows\system\CatRoot
2020-02-19 01:20 . 2020-02-19 01:20 ——– d-s—w c:\windows\Cookies
2020-02-19 01:20 . 2020-02-19 01:20 ——– d—–w c:\program files\DirectX
2020-02-19 01:19 . 2020-02-19 01:19 ——– d-s—w c:\windows\Favorites
2020-02-19 01:19 . 2009-05-09 13:37 ——– d-s—w c:\windows\Downloaded Program Files
2020-02-19 01:18 . 2020-02-19 01:18 ——– d–h–w c:\windows\Recent
2020-02-19 01:18 . 2004-12-31 13:08 ——– d—–w c:\windows\SendTo
2020-02-19 01:18 . 2020-02-19 01:18 ——– d—–w c:\windows\Start Menu
2020-02-19 01:17 . 2020-02-19 01:17 ——– d—–w c:\windows\Desktop
2020-02-19 01:17 . 2020-02-19 01:17 ——– d—–w c:\windows\All Users

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-02-19 01:19 . 2020-02-19 01:19 266 –sh–w c:\program files\desktop.ini
2020-02-19 01:19 . 2020-02-19 01:19 11079 —ha-w c:\program files\folder.htt
2019-02-20 01:10 . 2019-02-20 01:10 5166 –sh–w C:\SUHDLOG.DAT
2019-02-20 00:54 . 2019-02-20 00:54 ——– d—–w c:\program files\PLUS!
2019-02-20 00:54 . 2019-02-20 00:54 ——– d—–w c:\program files\CHAT
2019-02-20 00:54 . 2019-02-20 00:54 ——– d—–r c:\program files\Accessories
2009-05-17 21:31 . 2009-05-14 10:00 3218 —-a-w c:\windows\system32\PerfStringBackup.TMP
2009-05-17 21:31 . 2006-11-12 08:46 65536 —-a-w c:\documents and settings\jilly.BLUE_MOUNTAINS.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-16 00:01 . 2009-05-16 00:01 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-15 15:42 . 2008-05-30 23:11 ——– d—–w c:\program files\Warcraft III
2009-05-15 01:04 . 2009-05-15 01:04 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-05-14 14:51 . 2009-05-14 14:51 ——– d—–w c:\program files\Trend Micro
2009-05-13 07:15 . 2009-05-13 07:15 ——– d—–w c:\program files\NETGEAR
2009-05-12 06:01 . 2009-05-12 06:01 ——– d—–w c:\program files\VistaCodecPack
2009-05-11 11:11 . 2005-01-04 12:35 ——– d—–w c:\program files\Microsoft IntelliType Pro
2009-05-11 10:47 . 2009-05-11 10:47 ——– d—–w c:\program files\Realtek Sound Manager
2009-05-11 10:47 . 2004-12-16 19:57 ——– d—–w c:\program files\AvRack
2009-05-11 10:47 . 2009-05-11 10:47 ——– d—–w c:\program files\Realtek AC97
2009-05-11 10:39 . 2009-05-11 10:39 ——– d—–w c:\program files\CPUID
2009-05-09 04:54 . 2007-05-21 10:21 ——– d—–w c:\program files\EPSON
2009-05-09 04:51 . 2008-06-09 03:37 ——– d—–w c:\program files\AMUST
2009-05-09 04:43 . 2004-11-26 10:55 ——– d—–w c:\program files\MSN Messenger
2009-05-09 04:24 . 2004-12-31 02:48 22720 —-a-w c:\windows\system32\emptyregdb.dat
2009-05-09 04:23 . 2006-12-14 05:53 ——– d—–w c:\program files\Windows Media Connect 2
2009-05-03 16:37 . 2009-05-03 16:37 85504 —-a-w c:\windows\system32\ff_vfw.dll
2009-04-22 10:59 . 2009-04-22 10:59 1033728 —-a-w c:\windows\system32\VSFilter.dll
2009-04-06 05:32 . 2009-05-16 00:01 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 05:32 . 2009-05-16 00:01 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-29 15:57 . 2009-03-29 15:57 62149 —-a-w c:\windows\system32\pthreadGC2.dll
2009-03-26 15:16 . 2009-05-11 10:39 12672 —-a-w c:\windows\system32\drivers\cpuz132_x32.sys
2009-03-06 13:49 . 2008-04-14 04:42 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2008-12-20 22:15 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2009-01-08 19:20 78336 —-a-w c:\windows\system32\ieencode.dll
2005-04-05 09:27 . 2005-04-05 09:27 10493 ——w c:\program files\Chefs
.

——- Sigcheck ——-

[-] 2005-05-25 19:07 359936 63FDFEA54EB53DE2D863EE454937CE1E c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2009-01-08 20:12 361600 5AE1C2695F6523AD98B948F2887D8C5E c:\windows\SYSTEM32\DRIVERS\tcpip.sys

[-] 2009-01-08 19:41 1614848 362BC5AF8EAF712832C58CC13AE05750 c:\windows\SYSTEM32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-05-15_12.49.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-14 09:59 . 2008-04-14 04:42 26112 c:\windows\SYSTEM32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 68856]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-09-04 95536]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-10 40048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"cctray"="c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe" [2009-01-27 181488]
"CAVRID"="c:\program files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-09-10 234736]
"QOELOADER"="c:\program files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe" [2008-06-06 14088]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2007-09-04 54576]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-08-02 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
NETGEAR WG311v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG311v3\wlancfg5.exe [2006-1-26 1486848]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RegCompact]
2008-04-16 04:24 165368 —-a-w c:\windows\SYSTEM32\RegCompact.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0pgdfgsvc C 1

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\MyWebSearch Email Plugin.lnk
backup=c:\windows\pss\MyWebSearch Email Plugin.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^jilly.BLUE_MOUNTAINS^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\jilly.BLUE_MOUNTAINS\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^jilly.BLUE_MOUNTAINS^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\jilly.BLUE_MOUNTAINS\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\DOOM Collector's Edition\\Final Doom\\Doom95.exe"=
"%windir%\\system32\\ccapp.exe"=
"c:\\Program Files\\Black Isle\\BGII - SoA\\BGMain.exe"=
"c:\\Program Files\\Lionhead Studios Ltd\\Black & White\\runblack.exe"=
"c:\\SIERRA\\Half-Life\\hl.exe"=
"c:\\SIERRA\\Counter-Strike\\cstrike.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\Program Files\\Sierra On-Line\\SIGSPat.exe"=
"c:\\Program Files\\Steam\\SteamApps\\phunky_jill\\half-life deathmatch source\\hl2.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CA\\CA Internet Security Suite\\CA Anti-Virus\\vetmsg.exe"=

R3 PPCtlPriv;PPCtlPriv;c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [6/06/2008 6:39 PM 185584]
S3 cpuz132;cpuz132;c:\windows\SYSTEM32\DRIVERS\cpuz132_x32.sys [11/05/2009 8:39 PM 12672]
.
Contents of the 'Scheduled Tasks' folder

2008-10-05 c:\windows\Tasks\CAAntiSpywareScan_Daily as jilly at 6 39 PM.job
- c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe [2008-06-06 11:47]

2007-10-26 c:\windows\Tasks\I love you.job
- c:\documents and settings\jilly.BLUE_MOUNTAINS.000\Desktop\I love you.mht [2007-10-26 00:03]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.au/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\VetRedir.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-18 07:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\MrvGINA.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\CA\SharedComponents\PPRT\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRT\bin\CAServer.dll
c:\windows\system32\RegCompact.dll
.
Completion time: 2009-05-17 7:58
ComboFix-quarantined-files.txt 2009-05-17 21:58

Pre-Run: 249,364,872,192 bytes free
Post-Run: 249,503,126,528 bytes free

255

Thansk and regards,

Daniel

Hello,

The computer seems to be running perfectly fine. No slowdown, no popups, iexplorer is working fast. Everything seems very good!

Heres the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:44:43 PM, on 18/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-au\msntb.dll
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-au\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe"
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120882983921
O16 - DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC} -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Blue_Mountains
O17 - HKLM\Software\..\Telephony: DomainName = Blue_Mountains
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Blue_Mountains
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Blue_Mountains
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

–
End of file - 8658 bytes

Thanks and regards!
Daniel