[Resolved] my windows defender says everything is fine

Yes it seems to be doing better than it was but, I am still on the administrator account will my other account be treated the same or will I have to log on that account and complete the process over again. Ok here is the log: Malwarebytes' Anti-Malware 1.40 Database version: 2608 Windows 6.0.6001 Service Pack 1 8/11/2009 10:30:37 PM mbam-log-2009-08-11 (22-30-37).txt Scan type: Quick Scan Objects scanned: 106971 Time elapsed: 4 minute(s), 51 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 59 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 3 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\gamevancetext.linker.1 (Adware.Gamevance) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Users\Judy\AppData\Roaming\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Users\Judy\AppData\Roaming\ErrorSmart\Log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. Files Infected: C:\Users\Judy\AppData\Roaming\ErrorSmart\Log\2008 Sep 20 - 02_45_21 PM_146.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart\ErrorSmart.url (Rogue.ErrorSmart) -> Quarantined and deleted successfully.

Hi,

All your other accounts should be fine.

We need to do one more scan, to make sure you are thoroughly clean, before we clean up all the tools

Please do the following

Go here to run an online scanner from ESET.

• Note: You will need to use Internet explorer for this scan
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activeX control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
• Copy and paste that log as a reply to this topic and also let me know how things are now.

Hi, yeah everything seems to be back to normal but, I haven't really been on the internet that much. So far i have not seen any pop-ups or any redirected sites. Here is the log: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=6 # iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205) # OnlineScanner.ocx=1.0.0.5889 # api_version=3.0.2 # EOSSerial=bff3741959980044bb9cc0fef629ce31 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2009-08-12 04:28:27 # local_time=2009-08-12 12:28:27 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=6.0.6001 NT Service Pack 1 # compatibility_mode=5889 63 66 100 493229889315137 # compatibility_mode=7425 63 75 0 0 # scanned=171754 # found=115 # cleaned=0 # scan_time=4912 C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL Win32/Toolbar.AskSBar application 00000000000000000000000000000000 I C:\ProgramData\iolo\AntiVirus\Quarantined\AUTORUN.INF.INFECTED Win32/AutoRun.UG worm 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\BrowserCtl\BrowserCtl.dll.vir Win32/Tinxy.AD trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\BrowserCtl\BrowserCtl.sys.vir Win32/Tinxy.AH trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\Internet Explorer\msimg32.dll.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL.vir Win32/FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL.vir a variant of Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3HKSTUB.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL.vir Win32/Adware.FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL.vir Win32/FunWeb application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3MEDINT.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\Zumie\uninstall.exe.vir Win32/Adware.OneStep application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\Zumie\zopt.exe.vir Win32/Adware.OneStep application 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\freddy56.exe.vir a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\freddy57.exe.vir Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\ld12.exe.vir probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\mstre19.exe.vir a variant of Win32/Koobface.NBY worm 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\mstre20.exe.vir probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\pp10.exe.vir Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\f3PSSavr.scr.vir Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I C:\Users\All Users\iolo\AntiVirus\Quarantined\AUTORUN.INF.INFECTED Win32/AutoRun.UG worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249653631 Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249668273 probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249668411 Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249673713 probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249673719 Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249674254 probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249674286 Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249736765 probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249736857 Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249762936 Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249762942 probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249764299 Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249764303 probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249912590 probably a variant of Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249912593 Win32/Koobface.NCF worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249551841 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249556190 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249564682 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249570530 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249575972 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249653511 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249668291 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249673712 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249674253 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249736763 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249762947 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249764305 Win32/Koobface.NBH worm 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Incomplete\T-3545427-her booty got swag.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Incomplete\T-3545427-hustle all day plies.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Incomplete\T-3870556-ill hit that ###### with bat CD quality.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\her booty got swag CD quality.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\India Arie- Words.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\intuitions natasha beningfield.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\Jamie Foxx - DJ play a love song.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\love durg.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\phony and fake greatest hit 2009.wma WMA/TrojanDownloader.Wimad.NAD trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\she got donk part 2.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\sosa loves me lil wayne.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\streetlights plies.au a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\T.I. - Paper Trail - Let My Beat Pound.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Judy\Documents\LimeWire\Saved\wobble remix vic 192kb.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I C:\Users\Public\Downloads\DinerDash-HometownHero-dm[1].exe Win32/Adware.Trymedia application 00000000000000000000000000000000 I C:\Users\Public\Downloads\ExtremeFishing3DSetup-dm[1].exe Win32/Adware.Trymedia application 00000000000000000000000000000000 I ${Memory} Win32/Toolbar.AskSBar application 00000000000000000000000000000000 I

Hi,

Please do the following:

Please download OTM by OldTimer.

• Save it to your desktop.
• Please click OTM and then click >> run.
• Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe
:Services
:Reg
:Files
C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249653631
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249668273 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249668411
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249673713 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249673719 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249674254 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249674286
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249736765 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249736857 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249762936 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249762942 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249764299 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249764303 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249912590 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\nv_1249912593 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249551841 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249556190 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249564682 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249570530 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249575972 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249653511 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249668291 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249673712 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249674253
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249736763 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249762947 
C:\Users\Judy\AppData\Local\VirtualStore\Windows\vkl_1249764305 
C:\Users\Judy\Documents\LimeWire\Incomplete\T-3545427-her booty got swag.mp3 
C:\Users\Judy\Documents\LimeWire\Incomplete\T-3545427-hustle all day plies.mp3 
C:\Users\Judy\Documents\LimeWire\Incomplete\T-3870556-ill hit that ###### with bat CD quality.mp3 
C:\Users\Judy\Documents\LimeWire\Saved\her booty got swag CD quality.mp3 
C:\Users\Judy\Documents\LimeWire\Saved\India Arie- Words.mp3 
C:\Users\Judy\Documents\LimeWire\Saved\intuitions natasha beningfield.mp3 
C:\Users\Judy\Documents\LimeWire\Saved\Jamie Foxx - DJ play a love song.mp3 
C:\Users\Judy\Documents\LimeWire\Saved\love durg.mp3 
C:\Users\Judy\Documents\LimeWire\Saved\phony and fake greatest hit 2009.wma
C:\Users\Judy\Documents\LimeWire\Saved\she got donk part 2.wma
C:\Users\Judy\Documents\LimeWire\Saved\sosa loves me lil wayne.mp3 
C:\Users\Judy\Documents\LimeWire\Saved\streetlights plies.au 
C:\Users\Judy\Documents\LimeWire\Saved\T.I. - Paper Trail - Let My Beat Pound.mp3 
C:\Users\Judy\Documents\LimeWire\Saved\wobble remix vic 192kb.mp3 
C:\Users\Public\Downloads\DinerDash-HometownHero-dm[1].exe
C:\Users\Public\Downloads\ExtremeFishing3DSetup-dm[1].exe
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


NOTE

C:\Users\Judy\Documents\LimeWire\Incomplete\T-3870556-ill hit that ###### with bat CD quality.mp3

For this item here the ######'s are likely a swear word parsed by the forum software…that word needs to be changed back to the exact title of that item or OTM wont remove it.


Please post a fresh HJT log along with the OTM log as well as an uninstall list from HJT

Run HJT and click on Open the Misc Tools section.

• Click Open Uninstall Manager…
• Click Save list… and save it to your Desktop.
• Copy and paste the file uninstall_list.txt into your reply.

Hi, ok it still will not let me download that program it just freezes up and closes.

Hi, can you tell me what freezes up and what closes?

When I click on OTM to download it opens up then it freezes and then a message comes saying Check online for a solution or restart the program.

Hi, right click the icon and choose 'run as Administrator' see if that works

I'm on the administrator account when I right click on it there is no Run as Adminstrator

Try deleting the copy you have.

Download a fresh copy and run it, restart a couple of times, see if you can get it to run

If not run this program

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
  Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Ok, what copy and where would it be. I tried to download the other program and it does the same thing

The copy of OTM did it save to your desktop? are you able to save programs to your desktop now? when you downloaded OTM and OTL did the icons show up on your desktop?

Re-reading your post…are you saying that you cannot actually download these programs? when you click on the link what happens? do you get a dialog box popping up saying " you have chosen to open….. would you like to save this file?" what browser are you using?

Yes it will not download some programs will download and others will not. Im on internet explores 7.

sorry, I misunderstood, I thought it had downloaded and just would not open for you. so when you click on the link what happens?