This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please Help

45 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I've tried running Adaware and Norton anti-virus but my computer is still having problems. I've also tried going in and removing things manually. I'm not sure what is still wrong.

Logfile of HijackThis v1.99.1
Scan saved at 11:27:14 PM, on 3/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\windows\system32\cthjfcn.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\sofarta.exe
C:\windows\system32\calc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe
C:\Documents and Settings\Sarah Cooper\My Documents\Temp download stuff\hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.deviantart.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://contexualsearch.com/searchbar.html
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 216.177.73.139 search.netscape.com
O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\Pynix.dll
O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [LXBLKsk] C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe
O4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startup
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\Updater\wupdater.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [cthjfcn] c:\windows\system32\cthjfcn.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Ho7qRgMsT] sofarta.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (HKCU)
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…etup1.0.0.8.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.wildtangent.com/webdrivers/webinstall/Install.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {99E79790-2B09-11D6-8C73-0800460222F0} - http://www.andlotsmore.com/plug/install.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://contexualsearch.com/searchbar.html
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 216.177.73.139 search.netscape.com
O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\Pynix.dll
O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - (no file)
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\Updater\wupdater.exe
O4 - HKLM\..\Run: [cthjfcn] c:\windows\system32\cthjfcn.exe
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKCU\..\Run: [Ho7qRgMsT] sofarta.exe
O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe
O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (HKCU)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…etup1.0.0.8.cab
O16 - DPF: {99E79790-2B09-11D6-8C73-0800460222F0} - http://www.andlotsmore.com/plug/install.cab


Exit HijackThis when done. Reboot into Safe Mode by tapping F8 after the BIOS has loaded. Using Windows Explorer, find and delete the following:

C:\Program Files\Common files\Updater\ <– folder
c:\windows\system32\cthjfcn.exe
C:\Program Files\Ebates_MoeMoneyMaker\ <– folder

Exit Explorer and reboot into Normal Mode. Rescan with HijackThis and post a new log here.
Ok heres my new logfile

Logfile of HijackThis v1.99.1
Scan saved at 12:21:59 PM, on 3/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sarah Cooper\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.deviantart.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\dlmax.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [LXBLKsk] C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe
O4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startup
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.wildtangent.com/webdrivers/webinstall/Install.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
With only HJT running, have it fix:

O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"

Reboot and post a new log.
Logfile of HijackThis v1.99.1
Scan saved at 6:41:19 PM, on 3/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\windows\system32\cthjfcn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\windows\system32\calc.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\DrTemp\thnall2r.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Sarah Cooper\My Documents\hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.deviantart.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\dlmax.dll
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [LXBLKsk] C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe
O4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startup
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [cthjfcn] c:\windows\system32\cthjfcn.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.wildtangent.com/webdrivers/webinstall/Install.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Hmm… a pest has come back. Let's see what this identifies. Click here to download eScan's mwav application. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.
Here it is, looks like a bunch keep returning. File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\windows\system32\cthjfcn.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File c:\windows\system32\cthjfcn.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\localNRD.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Pynix.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wupdsnff.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\system32\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\CnPl.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\cxtpls_loader.EXE infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ngd.dll infected by "not-a-virus:Porn-Dialer.Win32.Hotes" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\PreInstaller_p1.exe infected by "Trojan-Downloader.Win32.Keenval.o" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\saie321.dll infected by "Trojan-Dropper.Win32.Small.nj" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\system32\sofarta.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Del350.tmp infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\DrTemp\thnall2r.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\i4C.tmp infected by "Trojan-Downloader.Win32.Totavel.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\pynix.cab infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Pynix.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Temporary Internet Files\Content.IE5\6I93MYDB\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI28E3.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI2F09.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI3C6.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI40A5.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI42B.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI44B3.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.cab infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI4846.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI7D4C.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIA0B.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIBBE.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\SARAHC~1\LOCALS~1\TEMPOR~1\Content.IE5\7RO2Y9AB\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\SARAHC~1\LOCALS~1\TEMPOR~1\Content.IE5\STABCPQF\MMaker4b[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Megasearch.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Del350.tmp infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\DrTemp\thnall2r.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\i4C.tmp infected by "Trojan-Downloader.Win32.Totavel.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\pynix.cab infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Pynix.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Temporary Internet Files\Content.IE5\6I93MYDB\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI28E3.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI2F09.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI3C6.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI40A5.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI42B.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI44B3.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.cab infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI4846.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI7D4C.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIA0B.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIBBE.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temporary Internet Files\Content.IE5\7RO2Y9AB\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temporary Internet Files\Content.IE5\STABCPQF\MMaker4b[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\My Documents\hijackthis\backups\backup-20050319-121129-798.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\Program Files\AIM\aim95.exe infected by "not-a-virus:AdWare.MiniBug" Virus. Action Taken: No Action Taken. File C:\Program Files\AIM\Sysfiles\WxBug.EXE infected by "not-a-virus:AdWare.MiniBug" Virus. Action Taken: No Action Taken. File C:\Program Files\Ebates_MoeMoneyMaker\disp350.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken. File C:\Program Files\NavExcel\NavHelper\v2.0.3\NHelper.dll infected by "not-a-virus:AdWare.NavExcel.d" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\02E11898 infected by "Trojan-Downloader.Win32.Small.akj" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\14640DB9.exe infected by "Trojan-Downloader.Win32.Small.qy" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\38670C18 infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\69264AE8.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\Program Files\Windows AdTools\WinWrench.dll infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc7\disp350.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc7\EbatesMoeMoneyMaker1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc8.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033564.dll infected by "not-a-virus:AdWare.BiSpy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033584.dll infected by "not-a-virus:AdWare.BiSpy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033585.exe infected by "not-a-virus:AdWare.BiSpy.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033628.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033629.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033631.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033633.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033634.exe infected by "not-a-virus:AdWare.BargainBuddy.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033637.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\snapshot\MFEX-1.DAT infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034024.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034038.exe infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034040.exe infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034041.exe infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034053.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034054.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034055.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034238.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034241.exe infected by "not-a-virus:AdWare.WebRebates.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034244.exe infected by "Trojan-Downloader.Win32.Small.qy" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034256.dll infected by "not-a-virus:AdWare.Relevance.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034258.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034261.EXE infected by "Trojan-Dropper.Win32.Small.ht" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034263.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP238\A0034283.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP239\A0034371.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP241\A0034504.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034523.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034535.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034583.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP243\A0034657.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP243\A0034889.dll infected by "not-a-virus:AdWare.MiniBug" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036148.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036152.dll infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036278.exe infected by "Trojan-Downloader.Win32.Agent.hc" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036279.exe infected by "Trojan-Downloader.Win32.Apropo.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036296.exe infected by "Trojan-Downloader.Win32.Apropo.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036297.exe infected by "Trojan-Dropper.Win32.Small.fl" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036299.exe infected by "not-a-virus:AdWare.Lop" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036301.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036304.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036305.exe infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036307.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036310.dll infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036324.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP245\A0036328.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP246\A0036342.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP247\A0036392.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP248\A0036399.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036403.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036415.exe infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036416.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036430.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP250\A0037430.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP252\A0037537.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP254\A0037584.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP255\A0037606.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037614.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037661.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037669.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037679.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP257\A0037687.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP258\A0037711.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037729.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037730.exe infected by "Trojan-Downloader.Win32.Small.akj" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037737.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037738.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037757.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037798.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP260\A0037814.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP260\A0038819.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038848.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038852.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038854.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038855.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038863.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038870.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038871.dll infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038872.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038873.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038874.EXE infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038875.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038887.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038894.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038895.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038912.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038916.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038917.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039012.dll infected by "Trojan-Downloader.Win32.Keenval.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039013.dll infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039014.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP263\A0039401.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP264\A0039405.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP265\A0039410.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP265\A0039488.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP266\A0039536.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP266\A0039537.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039542.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039544.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039545.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039546.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039567.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039616.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039629.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP269\A0039637.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP270\A0039668.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040654.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040655.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040656.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP272\A0040662.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040667.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040669.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040680.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP276\A0041095.dll infected by "not-a-virus:AdWare.Relevance.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041646.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041939.exe infected by "not-a-virus:AdWare.WinAD.s" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041940.dll infected by "not-a-virus:AdWare.WinAD.u" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041941.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041948.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041949.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041950.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041951.dll infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041952.exe infected by "not-a-virus:AdWare.BiSpy.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041961.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041978.exe infected by "not-a-virus:AdWare.MDH.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041979.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041980.exe infected by "Trojan-Downloader.NSIS.Gen" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041981.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042003.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042013.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042046.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042051.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042053.dll infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042063.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042069.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042077.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042079.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\eSearchBar\eu_Filesubmit_p1.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\WINDOWS\iNetPal\m3tsp8.exe infected by "Trojan-Dropper.Win32.Small.ff" Virus. Action Taken: No Action Taken. File C:\WINDOWS\LastGood\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\localNRD.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Lycos\ss_IGN1_setup.exe infected by "not-a-virus:AdWare.Sidesearch.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Pynix.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\CnPl.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\cxtpls_loader.EXE infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\ngd.dll infected by "not-a-virus:Porn-Dialer.Win32.Hotes" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\PreInstaller_p1.exe infected by "Trojan-Downloader.Win32.Keenval.o" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\saie321.dll infected by "Trojan-Dropper.Win32.Small.nj" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\SYSTEM32\sofarta.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\OLD355.tmp infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wt\wtvh.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wupdsnff.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
This is a repost, so I don't go MIA Here it is, looks like a bunch keep returning. File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\windows\system32\cthjfcn.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File c:\windows\system32\cthjfcn.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\localNRD.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Pynix.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wupdsnff.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\system32\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\CnPl.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\cxtpls_loader.EXE infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ngd.dll infected by "not-a-virus:Porn-Dialer.Win32.Hotes" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\PreInstaller_p1.exe infected by "Trojan-Downloader.Win32.Keenval.o" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\saie321.dll infected by "Trojan-Dropper.Win32.Small.nj" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\system32\sofarta.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Del350.tmp infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\DrTemp\thnall2r.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\i4C.tmp infected by "Trojan-Downloader.Win32.Totavel.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\pynix.cab infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Pynix.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Temporary Internet Files\Content.IE5\6I93MYDB\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI28E3.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI2F09.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI3C6.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI40A5.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI42B.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI44B3.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.cab infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI4846.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI7D4C.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIA0B.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIBBE.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\SARAHC~1\LOCALS~1\TEMPOR~1\Content.IE5\7RO2Y9AB\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\SARAHC~1\LOCALS~1\TEMPOR~1\Content.IE5\STABCPQF\MMaker4b[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Megasearch.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Del350.tmp infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\DrTemp\thnall2r.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\i4C.tmp infected by "Trojan-Downloader.Win32.Totavel.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\pynix.cab infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Pynix.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Temporary Internet Files\Content.IE5\6I93MYDB\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI28E3.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI2F09.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI3C6.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI40A5.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI42B.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI44B3.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.cab infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI4846.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI7D4C.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIA0B.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIBBE.tmp\MMaker4b.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temporary Internet Files\Content.IE5\7RO2Y9AB\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temporary Internet Files\Content.IE5\STABCPQF\MMaker4b[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\My Documents\hijackthis\backups\backup-20050319-121129-798.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\Program Files\AIM\aim95.exe infected by "not-a-virus:AdWare.MiniBug" Virus. Action Taken: No Action Taken. File C:\Program Files\AIM\Sysfiles\WxBug.EXE infected by "not-a-virus:AdWare.MiniBug" Virus. Action Taken: No Action Taken. File C:\Program Files\Ebates_MoeMoneyMaker\disp350.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken. File C:\Program Files\NavExcel\NavHelper\v2.0.3\NHelper.dll infected by "not-a-virus:AdWare.NavExcel.d" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\02E11898 infected by "Trojan-Downloader.Win32.Small.akj" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\14640DB9.exe infected by "Trojan-Downloader.Win32.Small.qy" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\38670C18 infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\69264AE8.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\Program Files\Windows AdTools\WinWrench.dll infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc7\disp350.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc7\EbatesMoeMoneyMaker1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc8.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033564.dll infected by "not-a-virus:AdWare.BiSpy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033584.dll infected by "not-a-virus:AdWare.BiSpy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033585.exe infected by "not-a-virus:AdWare.BiSpy.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033628.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033629.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033631.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033633.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033634.exe infected by "not-a-virus:AdWare.BargainBuddy.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033637.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\snapshot\MFEX-1.DAT infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034024.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034038.exe infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034040.exe infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034041.exe infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034053.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034054.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034055.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034238.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034241.exe infected by "not-a-virus:AdWare.WebRebates.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034244.exe infected by "Trojan-Downloader.Win32.Small.qy" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034256.dll infected by "not-a-virus:AdWare.Relevance.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034258.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034261.EXE infected by "Trojan-Dropper.Win32.Small.ht" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034263.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP238\A0034283.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP239\A0034371.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP241\A0034504.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034523.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034535.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034583.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP243\A0034657.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP243\A0034889.dll infected by "not-a-virus:AdWare.MiniBug" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036148.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036152.dll infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036278.exe infected by "Trojan-Downloader.Win32.Agent.hc" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036279.exe infected by "Trojan-Downloader.Win32.Apropo.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036296.exe infected by "Trojan-Downloader.Win32.Apropo.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036297.exe infected by "Trojan-Dropper.Win32.Small.fl" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036299.exe infected by "not-a-virus:AdWare.Lop" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036301.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036304.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036305.exe infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036307.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036310.dll infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036324.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP245\A0036328.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP246\A0036342.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP247\A0036392.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP248\A0036399.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036403.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036415.exe infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036416.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036430.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP250\A0037430.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP252\A0037537.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP254\A0037584.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP255\A0037606.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037614.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037661.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037669.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037679.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP257\A0037687.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP258\A0037711.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037729.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037730.exe infected by "Trojan-Downloader.Win32.Small.akj" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037737.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037738.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037757.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037798.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP260\A0037814.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP260\A0038819.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038848.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038852.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038854.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038855.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038863.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038870.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038871.dll infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038872.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038873.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038874.EXE infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038875.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038887.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038894.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038895.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038912.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038916.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038917.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039012.dll infected by "Trojan-Downloader.Win32.Keenval.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039013.dll infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039014.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP263\A0039401.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP264\A0039405.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP265\A0039410.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP265\A0039488.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP266\A0039536.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP266\A0039537.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039542.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039544.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039545.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039546.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039567.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039616.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039629.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP269\A0039637.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP270\A0039668.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040654.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040655.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040656.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP272\A0040662.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040667.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040669.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040680.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP276\A0041095.dll infected by "not-a-virus:AdWare.Relevance.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041646.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041939.exe infected by "not-a-virus:AdWare.WinAD.s" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041940.dll infected by "not-a-virus:AdWare.WinAD.u" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041941.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041948.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041949.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041950.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041951.dll infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041952.exe infected by "not-a-virus:AdWare.BiSpy.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041961.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041978.exe infected by "not-a-virus:AdWare.MDH.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041979.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041980.exe infected by "Trojan-Downloader.NSIS.Gen" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041981.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042003.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042013.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042046.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042051.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042053.dll infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042063.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042069.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042077.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042079.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\eSearchBar\eu_Filesubmit_p1.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\WINDOWS\iNetPal\m3tsp8.exe infected by "Trojan-Dropper.Win32.Small.ff" Virus. Action Taken: No Action Taken. File C:\WINDOWS\LastGood\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\localNRD.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Lycos\ss_IGN1_setup.exe infected by "not-a-virus:AdWare.Sidesearch.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Pynix.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\CnPl.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\cxtpls_loader.EXE infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\ngd.dll infected by "not-a-virus:Porn-Dialer.Win32.Hotes" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\PreInstaller_p1.exe infected by "Trojan-Downloader.Win32.Keenval.o" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\saie321.dll infected by "Trojan-Dropper.Win32.Small.nj" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\SYSTEM32\sofarta.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\OLD355.tmp infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wt\wtvh.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wupdsnff.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file to your desktop.

Start Killbox and click on Tools->Delete Temp Files. When that finishes, copy and paste each of the following lines into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Del350.tmp
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\DrTemp\thnall2r.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\i4C.tmp
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\pynix.cab
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Pynix.dl
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\randreco.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\Temporary Internet Files\Content.IE5\6I93MYDB\thnall2r[1].exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI28E3.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI2F09.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI3C6.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI40A5.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI42B.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI44B3.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.cab
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI45E0.tmp\dlmax.dl
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI4846.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THI7D4C.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIA0B.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temp\THIBBE.tmp\MMaker4b.exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temporary Internet Files\Content.IE5\7RO2Y9AB\thnall2r[1].exe
C:\Documents and Settings\Sarah Cooper\Local Settings\Temporary Internet Files\Content.IE5\STABCPQF\MMaker4b[1].exe
C:\Documents and Settings\Sarah Cooper\My Documents\hijackthis\backups\backup-20050319-121129-798.dll
C:\Program Files\AIM\aim95.ex
C:\Program Files\AIM\Sysfiles\WxBug.EX
C:\Program Files\Ebates_MoeMoneyMaker\disp350.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe
C:\Program Files\NavExcel\NavHelper\v2.0.3\NHelper.dll
C:\Program Files\Windows AdTools\WinWrench.dll
C:\WINDOWS\dlmax.dl
C:\WINDOWS\eSearchBar\eu_Filesubmit_p1.exe
C:\WINDOWS\iNetPal\m3tsp8.exe
C:\WINDOWS\LastGood\dlmax.dl
C:\WINDOWS\localNRD.dll
C:\WINDOWS\Lycos\ss_IGN1_setup.exe
C:\WINDOWS\Pynix.dll
C:\WINDOWS\systb.exe
C:\WINDOWS\system32\ATPartners.dl
C:\WINDOWS\SYSTEM32\CnPl.dll
C:\windows\system32\cthjfcn.exe
C:\WINDOWS\SYSTEM32\cxtpls_loader.EXE
C:\WINDOWS\SYSTEM32\ngd.dll
C:\WINDOWS\SYSTEM32\PreInstaller_p1.exe
C:\WINDOWS\SYSTEM32\randreco.exe
C:\WINDOWS\system32\saie321.dll
C:\WINDOWS\SYSTEM32\sofarta.exe
C:\WINDOWS\Temp\OLD355.tmp
C:\WINDOWS\wt\wtvh.dll
C:\WINDOWS\wupdsnff.exe

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

Reboot if it doesn't do so automatically. Post a new mwav scan in your next reply.
Ok, heres what I got this time File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.dll_tobedeleted infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\system32\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\DOCUME~1\SARAHC~1\LOCALS~1\TEMPOR~1\Content.IE5\26QV77B2\stats5[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.dll_tobedeleted infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sorry, forgot to hit scan all files, heres the real one File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.dll_tobedeleted infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\system32\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\DOCUME~1\SARAHC~1\LOCALS~1\TEMPOR~1\Content.IE5\26QV77B2\stats5[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\!Submit\backup-20050319-121129-798.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\!Submit\CnPl.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\!Submit\cthjfcn.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\!Submit\cxtpls_loader.EXE infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\!Submit\disp350.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\!Submit\EbatesMoeMoneyMaker1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\!Submit\eu_Filesubmit_p1.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\!Submit\localNRD.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\!Submit\m3tsp8.exe infected by "Trojan-Dropper.Win32.Small.ff" Virus. Action Taken: No Action Taken. File C:\!Submit\MMaker4b[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\!Submit\ngd.dll infected by "not-a-virus:Porn-Dialer.Win32.Hotes" Virus. Action Taken: No Action Taken. File C:\!Submit\NHelper.dll infected by "not-a-virus:AdWare.NavExcel.d" Virus. Action Taken: No Action Taken. File C:\!Submit\OLD355.tmp infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\!Submit\PreInstaller_p1.exe infected by "Trojan-Downloader.Win32.Keenval.o" Virus. Action Taken: No Action Taken. File C:\!Submit\Pynix.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\!Submit\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\!Submit\saie321.dll infected by "Trojan-Dropper.Win32.Small.nj" Virus. Action Taken: No Action Taken. File C:\!Submit\sofarta.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\!Submit\ss_IGN1_setup.exe infected by "not-a-virus:AdWare.Sidesearch.d" Virus. Action Taken: No Action Taken. File C:\!Submit\systb.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\!Submit\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\!Submit\WinWrench.dll infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\!Submit\wtvh.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\!Submit\wupdsnff.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Megasearch.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temporary Internet Files\Content.IE5\26QV77B2\stats5[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\02E11898 infected by "Trojan-Downloader.Win32.Small.akj" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\14640DB9.exe infected by "Trojan-Downloader.Win32.Small.qy" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\38670C18 infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\69264AE8.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc7\disp350.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc7\EbatesMoeMoneyMaker1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc8.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033564.dll infected by "not-a-virus:AdWare.BiSpy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033584.dll infected by "not-a-virus:AdWare.BiSpy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033585.exe infected by "not-a-virus:AdWare.BiSpy.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033628.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033629.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033631.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033633.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033634.exe infected by "not-a-virus:AdWare.BargainBuddy.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\A0033637.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP234\snapshot\MFEX-1.DAT infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034024.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034038.exe infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034040.exe infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034041.exe infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034053.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034054.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP236\A0034055.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034238.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034241.exe infected by "not-a-virus:AdWare.WebRebates.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034244.exe infected by "Trojan-Downloader.Win32.Small.qy" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034256.dll infected by "not-a-virus:AdWare.Relevance.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034258.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034261.EXE infected by "Trojan-Dropper.Win32.Small.ht" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP237\A0034263.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP238\A0034283.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP239\A0034371.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP241\A0034504.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034523.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034535.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP242\A0034583.exe infected by "Trojan-Downloader.Win32.OneClickNetSearch.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP243\A0034657.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036148.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036152.dll infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036278.exe infected by "Trojan-Downloader.Win32.Agent.hc" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036279.exe infected by "Trojan-Downloader.Win32.Apropo.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036296.exe infected by "Trojan-Downloader.Win32.Apropo.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036297.exe infected by "Trojan-Dropper.Win32.Small.fl" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036299.exe infected by "not-a-virus:AdWare.Lop" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036301.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036304.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036305.exe infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036307.dll infected by "not-a-virus:AdWare.Apropos.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036310.dll infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP244\A0036324.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP245\A0036328.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP246\A0036342.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP247\A0036392.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP248\A0036399.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036403.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036415.exe infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036416.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP249\A0036430.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP250\A0037430.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP252\A0037537.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP254\A0037584.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP255\A0037606.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037614.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037661.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037669.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP256\A0037679.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP257\A0037687.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP258\A0037711.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037729.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037730.exe infected by "Trojan-Downloader.Win32.Small.akj" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037737.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037738.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037757.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP259\A0037798.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP260\A0037814.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP260\A0038819.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038848.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038852.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038854.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038855.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038863.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038870.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038871.dll infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038872.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038873.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038874.EXE infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038875.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038887.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038894.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP261\A0038895.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038912.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038916.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0038917.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039012.dll infected by "Trojan-Downloader.Win32.Keenval.e" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039013.dll infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP262\A0039014.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP263\A0039401.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP264\A0039405.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP265\A0039410.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP265\A0039488.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP266\A0039536.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP266\A0039537.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039542.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039544.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039545.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP267\A0039546.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039567.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039616.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP268\A0039629.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP269\A0039637.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP270\A0039668.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040654.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040655.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP271\A0040656.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP272\A0040662.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040667.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040669.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP273\A0040680.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP276\A0041095.dll infected by "not-a-virus:AdWare.Relevance.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041646.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041939.exe infected by "not-a-virus:AdWare.WinAD.s" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041940.dll infected by "not-a-virus:AdWare.WinAD.u" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041941.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041948.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041949.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041950.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041951.dll infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041952.exe infected by "not-a-virus:AdWare.BiSpy.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP279\A0041961.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041978.exe infected by "not-a-virus:AdWare.MDH.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041979.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041980.exe infected by "Trojan-Downloader.NSIS.Gen" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0041981.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042003.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042013.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP280\A0042046.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042051.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042053.dll infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP281\A0042063.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042069.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042077.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042079.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042086.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP282\A0042087.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP284\A0042104.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP284\A0042106.dll infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042118.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042119.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042120.dll infected by "not-a-virus:AdWare.NavExcel.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042121.dll infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042122.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042123.exe infected by "Trojan-Dropper.Win32.Small.ff" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042124.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042125.exe infected by "not-a-virus:AdWare.Sidesearch.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042126.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042127.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042128.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042129.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042130.EXE infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042131.dll infected by "not-a-virus:Porn-Dialer.Win32.Hotes" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042132.exe infected by "Trojan-Downloader.Win32.Keenval.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042133.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042134.dll infected by "Trojan-Dropper.Win32.Small.nj" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042135.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042136.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042137.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP285\A0042144.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.dll_tobedeleted infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.dll_tobedeleted infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Click Start>Run. Copy & paste the following and click OK.

regsvr32.exe /U dlmax.dll

You should get a message that it has been uninstalled succesfully

Repeat the Killbox sequence on these:

C:\WINDOWS\dlmax.dll
C:\WINDOWS\systb.dll_tobedeleted
C:\WINDOWS\system32\ATPartners.dll


Then follow this sequence:

1. Right-click My Computer>Click Properties>Click the System Restore tab>Check the box next to 'Turn off System Restore on all drives'>Click Apply>Click OK.

2. Reboot.

3. Repeat the process but this time remove the check from the box.

Post a new mwav scan and HJT log when done.
Logfile of HijackThis v1.99.1
Scan saved at 7:09:29 AM, on 3/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sarah Cooper\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.deviantart.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [LXBLKsk] C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe
O4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startup
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.wildtangent.com/webdrivers/webinstall/Install.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
And here is the mwav scan, File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\system32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\!Submit\ATPartners.dll infected by "not-a-virus:AdWare.F1Organizer.c" Virus. Action Taken: No Action Taken. File C:\!Submit\backup-20050319-121129-798.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\!Submit\CnPl.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\!Submit\cthjfcn.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\!Submit\cxtpls_loader.EXE infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\!Submit\disp350.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\!Submit\dlmax.dll infected by "not-a-virus:AdWare.DlMax.a" Virus. Action Taken: No Action Taken. File C:\!Submit\EbatesMoeMoneyMaker1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\!Submit\eu_Filesubmit_p1.exe infected by "Trojan-Downloader.Win32.Keenval" Virus. Action Taken: No Action Taken. File C:\!Submit\localNRD.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\!Submit\m3tsp8.exe infected by "Trojan-Dropper.Win32.Small.ff" Virus. Action Taken: No Action Taken. File C:\!Submit\MMaker4b[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\!Submit\ngd.dll infected by "not-a-virus:Porn-Dialer.Win32.Hotes" Virus. Action Taken: No Action Taken. File C:\!Submit\NHelper.dll infected by "not-a-virus:AdWare.NavExcel.d" Virus. Action Taken: No Action Taken. File C:\!Submit\OLD355.tmp infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\!Submit\PreInstaller_p1.exe infected by "Trojan-Downloader.Win32.Keenval.o" Virus. Action Taken: No Action Taken. File C:\!Submit\Pynix.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken. File C:\!Submit\randreco.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\!Submit\saie321.dll infected by "Trojan-Dropper.Win32.Small.nj" Virus. Action Taken: No Action Taken. File C:\!Submit\sofarta.exe infected by "Trojan-Downloader.Win32.Agent.ji" Virus. Action Taken: No Action Taken. File C:\!Submit\ss_IGN1_setup.exe infected by "not-a-virus:AdWare.Sidesearch.d" Virus. Action Taken: No Action Taken. File C:\!Submit\systb.dll_tobedeleted infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\!Submit\systb.exe infected by "not-a-virus:AdWare.ToolBar.ImiBar.d" Virus. Action Taken: No Action Taken. File C:\!Submit\thnall2r[1].exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\!Submit\WinWrench.dll infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken. File C:\!Submit\wtvh.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken. File C:\!Submit\wupdsnff.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Megasearch.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Sarah Cooper\Local Settings\Temporary Internet Files\Content.IE5\26QV77B2\stats5[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\02E11898 infected by "Trojan-Downloader.Win32.Small.akj" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\14640DB9.exe infected by "Trojan-Downloader.Win32.Small.qy" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\38670C18 infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\69264AE8.dll infected by "Trojan-Dropper.Win32.Small.so" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc7\disp350.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc7\EbatesMoeMoneyMaker1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-345260714-324295015-1108005934-1006\Dc8.exe infected by "Trojan.Win32.Agent.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\SYSTEM32\Snounin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Looking better. Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe


Exit HijackThis when done. Reboot, rescan with HijackThis and post a final log here.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI