What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Can someone please help read & fix my log

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 4:32:08 PM, on 5/13/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\NeroCheck.exe
C:\WINDOWS\newsd32.exe
C:\Program Files\Ares\Ares.exe
C:\Documents and Settings\steven\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\steven\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\steven\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 127.0.0.3 iframeprofit.com
O1 - Hosts: 127.0.0.3 www.iframeprofit.com
O1 - Hosts: 127.0.0.3 www.loadcash.biz
O1 - Hosts: 127.0.0.3 loadcash.biz
O1 - Hosts: 127.0.0.3 traffic2cash.biz
O1 - Hosts: 127.0.0.3 www.traffic2cash.biz
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 www.iframedollars.biz
O1 - Hosts: 127.0.0.3 iframedollars.biz
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
O1 - Hosts: 127.0.0.3 x.full-tgp.net
O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
O1 - Hosts: 127.0.0.3 autoescrowpay.com
O2 - BHO: (no name) - {94D26C07-68A5-4BA6-9F78-0A72852D70B5} - C:\WINDOWS\System32\mhgmaaa.dll (file missing)
O2 - BHO: (no name) - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [msnmsgq32] C:\WINDOWS\msnmsgq.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Vah] C:\WINDOWS\System32\Mem.exe
O4 - HKLM\..\Run: [Knt] C:\WINDOWS\Hsf.exe
O4 - HKLM\..\Run: [Ura] C:\WINDOWS\Ecp.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [Cdj] C:\WINDOWS\All.exe
O4 - HKLM\..\Run: [Ouk] C:\WINDOWS\System32\Kqb.exe
O4 - HKLM\..\Run: [Uvq] C:\WINDOWS\System32\Elr.exe
O4 - HKLM\..\Run: [Gon] C:\WINDOWS\System32\Hdr.exe
O4 - HKLM\..\Run: [Qur] C:\WINDOWS\System32\Apn.exe
O4 - HKLM\..\Run: [Mcr] C:\WINDOWS\System32\Svo.exe
O4 - HKLM\..\Run: [Nhi] C:\WINDOWS\Qsr.exe
O4 - HKLM\..\Run: [Jcc] C:\WINDOWS\Tpv.exe
O4 - HKLM\..\Run: [Ibs] C:\WINDOWS\Jbt.exe
O4 - HKLM\..\Run: [Drr] C:\WINDOWS\Bka.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [Alq] C:\WINDOWS\System32\Amn.exe
O4 - HKLM\..\Run: [Hqu] C:\WINDOWS\Ocq.exe
O4 - HKLM\..\Run: [Veq] C:\WINDOWS\Bse.exe
O4 - HKLM\..\Run: [Fop] C:\WINDOWS\System32\Cbc.exe
O4 - HKLM\..\Run: [Plp] C:\WINDOWS\Ocm.exe
O4 - HKLM\..\Run: [Iko] C:\WINDOWS\Sas.exe
O4 - HKLM\..\Run: [Vbm] C:\WINDOWS\Fim.exe
O4 - HKLM\..\Run: [Gdi] C:\WINDOWS\System32\Eef.exe
O4 - HKLM\..\Run: [Gih] C:\WINDOWS\Ovj.exe
O4 - HKLM\..\Run: [Mmf] C:\WINDOWS\Nup.exe
O4 - HKLM\..\Run: [Jhj] C:\WINDOWS\Jpv.exe
O4 - HKLM\..\Run: [Bjs] C:\WINDOWS\System32\Kjk.exe
O4 - HKLM\..\Run: [Mbc] C:\WINDOWS\System32\Epi.exe
O4 - HKLM\..\Run: [Kic] C:\WINDOWS\Qms.exe
O4 - HKLM\..\Run: [Biq] C:\WINDOWS\System32\Udc.exe
O4 - HKLM\..\Run: [Unv] C:\WINDOWS\System32\Usu.exe
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\Run: [ccApp] C:\WINDOWS\NeroCheck.exe /i
O4 - HKLM\..\Run: [supernews12] C:\WINDOWS\newsd32.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Vah] C:\WINDOWS\System32\Mem.exe
O4 - HKCU\..\Run: [Knt] C:\WINDOWS\Hsf.exe
O4 - HKCU\..\Run: [Ura] C:\WINDOWS\Ecp.exe
O4 - HKCU\..\Run: [Cdj] C:\WINDOWS\All.exe
O4 - HKCU\..\Run: [Ouk] C:\WINDOWS\System32\Kqb.exe
O4 - HKCU\..\Run: [Uvq] C:\WINDOWS\System32\Elr.exe
O4 - HKCU\..\Run: [Gon] C:\WINDOWS\System32\Hdr.exe
O4 - HKCU\..\Run: [Qur] C:\WINDOWS\System32\Apn.exe
O4 - HKCU\..\Run: [Mcr] C:\WINDOWS\System32\Svo.exe
O4 - HKCU\..\Run: [Nhi] C:\WINDOWS\Qsr.exe
O4 - HKCU\..\Run: [Jcc] C:\WINDOWS\Tpv.exe
O4 - HKCU\..\Run: [Ibs] C:\WINDOWS\Jbt.exe
O4 - HKCU\..\Run: [Drr] C:\WINDOWS\Bka.exe
O4 - HKCU\..\Run: [Alq] C:\WINDOWS\System32\Amn.exe
O4 - HKCU\..\Run: [Hqu] C:\WINDOWS\Ocq.exe
O4 - HKCU\..\Run: [Veq] C:\WINDOWS\Bse.exe
O4 - HKCU\..\Run: [Fop] C:\WINDOWS\System32\Cbc.exe
O4 - HKCU\..\Run: [Plp] C:\WINDOWS\Ocm.exe
O4 - HKCU\..\Run: [Iko] C:\WINDOWS\Sas.exe
O4 - HKCU\..\Run: [Vbm] C:\WINDOWS\Fim.exe
O4 - HKCU\..\Run: [Gdi] C:\WINDOWS\System32\Eef.exe
O4 - HKCU\..\Run: [Gih] C:\WINDOWS\Ovj.exe
O4 - HKCU\..\Run: [Mmf] C:\WINDOWS\Nup.exe
O4 - HKCU\..\Run: [Jhj] C:\WINDOWS\Jpv.exe
O4 - HKCU\..\Run: [Bjs] C:\WINDOWS\System32\Kjk.exe
O4 - HKCU\..\Run: [Mbc] C:\WINDOWS\System32\Epi.exe
O4 - HKCU\..\Run: [Kic] C:\WINDOWS\Qms.exe
O4 - HKCU\..\Run: [Biq] C:\WINDOWS\System32\Udc.exe
O4 - HKCU\..\Run: [Unv] C:\WINDOWS\System32\Usu.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Intel® 82845G/GL/GE/PE/GV Graphics Controller Power Management (ialmpa) - Unknown owner - C:\WINDOWS\System32\pmsvc.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Post #2
Hello skyc9345 and welcome to TomCoyote. :wavey:

You have two major infection on your computer. This will take several posts to get the computer clean.

You may want to print out these instructions or save them to your desktop as a text file with Notepad because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet.
  • Prepare CWShredder for use:
    • Download CWShredder.
    • Save CWShredder.exe to a convenient location.
    • Please do not do anything with it yet.
  • Prepare SpSeHjfix
    • Download SpSeHjfix from here.
    • Unzip the contents of SpSeHjfix112.zip.
    • Please do not do anything with it yet.
  • Clean out temporary files:
    • Start | Run | type cleanmgr | OK
    • Let it scan your system for files to remove.
    • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
    • Click "OK" to remove them.
    • Click "Yes" to confirm the deletion.

Boot into Safe Mode:
Restart your computer and immediately begin tapping the F8 key on your keyboard.
If done right a Windows Advanced Options menu will appear. Select the Safe Mode option and press Enter.
To return to normal mode just restart your computer as you normally would.
  • Disconnect from the Internet and Close ALL OPEN PROGRAMS.
    • Run 'SpSeHjfix'. and click on "Start Disinfection".
    • When it's finished it will reboot your machine to finish the cleaning process.
    • The tool creates a log of the fix which will appear in the folder.
  • Run CWShredder:
    • Double-click on CWShredder.exe.
    • Click "Fix ->" and click "OK" at the prompt.
    • CWShredder will scan and clean your system of CWS files.
    • Click "Next->" and then "Exit".
  • Reboot and repeat the process above.
  • Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix' as a reply to this thread.
Post #3
:thumbup: OK done as instructed , here's the latest logs :

HJT -
Logfile of HijackThis v1.99.1
Scan saved at 9:44:37 AM, on 5/19/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\newsd32.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\steven\Desktop\HijackThis- careful do not click this.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O1 - Hosts: 127.0.0.3 iframeprofit.com
O1 - Hosts: 127.0.0.3 www.iframeprofit.com
O1 - Hosts: 127.0.0.3 www.loadcash.biz
O1 - Hosts: 127.0.0.3 loadcash.biz
O1 - Hosts: 127.0.0.3 traffic2cash.biz
O1 - Hosts: 127.0.0.3 www.traffic2cash.biz
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 www.iframedollars.biz
O1 - Hosts: 127.0.0.3 iframedollars.biz
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
O1 - Hosts: 127.0.0.3 x.full-tgp.net
O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
O1 - Hosts: 127.0.0.3 autoescrowpay.com
O2 - BHO: (no name) - {94D26C07-68A5-4BA6-9F78-0A72852D70B5} - C:\WINDOWS\System32\mhgmaaa.dll (file missing)
O2 - BHO: (no name) - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [msnmsgq32] C:\WINDOWS\msnmsgq.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Vah] C:\WINDOWS\System32\Mem.exe
O4 - HKLM\..\Run: [Knt] C:\WINDOWS\Hsf.exe
O4 - HKLM\..\Run: [Ura] C:\WINDOWS\Ecp.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [Cdj] C:\WINDOWS\All.exe
O4 - HKLM\..\Run: [Ouk] C:\WINDOWS\System32\Kqb.exe
O4 - HKLM\..\Run: [Uvq] C:\WINDOWS\System32\Elr.exe
O4 - HKLM\..\Run: [Gon] C:\WINDOWS\System32\Hdr.exe
O4 - HKLM\..\Run: [Qur] C:\WINDOWS\System32\Apn.exe
O4 - HKLM\..\Run: [Mcr] C:\WINDOWS\System32\Svo.exe
O4 - HKLM\..\Run: [Nhi] C:\WINDOWS\Qsr.exe
O4 - HKLM\..\Run: [Jcc] C:\WINDOWS\Tpv.exe
O4 - HKLM\..\Run: [Ibs] C:\WINDOWS\Jbt.exe
O4 - HKLM\..\Run: [Drr] C:\WINDOWS\Bka.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [Alq] C:\WINDOWS\System32\Amn.exe
O4 - HKLM\..\Run: [Hqu] C:\WINDOWS\Ocq.exe
O4 - HKLM\..\Run: [Veq] C:\WINDOWS\Bse.exe
O4 - HKLM\..\Run: [Fop] C:\WINDOWS\System32\Cbc.exe
O4 - HKLM\..\Run: [Plp] C:\WINDOWS\Ocm.exe
O4 - HKLM\..\Run: [Iko] C:\WINDOWS\Sas.exe
O4 - HKLM\..\Run: [Vbm] C:\WINDOWS\Fim.exe
O4 - HKLM\..\Run: [Gdi] C:\WINDOWS\System32\Eef.exe
O4 - HKLM\..\Run: [Gih] C:\WINDOWS\Ovj.exe
O4 - HKLM\..\Run: [Mmf] C:\WINDOWS\Nup.exe
O4 - HKLM\..\Run: [Jhj] C:\WINDOWS\Jpv.exe
O4 - HKLM\..\Run: [Bjs] C:\WINDOWS\System32\Kjk.exe
O4 - HKLM\..\Run: [Mbc] C:\WINDOWS\System32\Epi.exe
O4 - HKLM\..\Run: [Kic] C:\WINDOWS\Qms.exe
O4 - HKLM\..\Run: [Biq] C:\WINDOWS\System32\Udc.exe
O4 - HKLM\..\Run: [Unv] C:\WINDOWS\System32\Usu.exe
O4 - HKLM\..\Run: [ccApp] C:\WINDOWS\NeroCheck.exe /i
O4 - HKLM\..\Run: [supernews12] C:\WINDOWS\newsd32.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Vah] C:\WINDOWS\System32\Mem.exe
O4 - HKCU\..\Run: [Knt] C:\WINDOWS\Hsf.exe
O4 - HKCU\..\Run: [Ura] C:\WINDOWS\Ecp.exe
O4 - HKCU\..\Run: [Cdj] C:\WINDOWS\All.exe
O4 - HKCU\..\Run: [Ouk] C:\WINDOWS\System32\Kqb.exe
O4 - HKCU\..\Run: [Uvq] C:\WINDOWS\System32\Elr.exe
O4 - HKCU\..\Run: [Gon] C:\WINDOWS\System32\Hdr.exe
O4 - HKCU\..\Run: [Qur] C:\WINDOWS\System32\Apn.exe
O4 - HKCU\..\Run: [Mcr] C:\WINDOWS\System32\Svo.exe
O4 - HKCU\..\Run: [Nhi] C:\WINDOWS\Qsr.exe
O4 - HKCU\..\Run: [Jcc] C:\WINDOWS\Tpv.exe
O4 - HKCU\..\Run: [Ibs] C:\WINDOWS\Jbt.exe
O4 - HKCU\..\Run: [Drr] C:\WINDOWS\Bka.exe
O4 - HKCU\..\Run: [Alq] C:\WINDOWS\System32\Amn.exe
O4 - HKCU\..\Run: [Hqu] C:\WINDOWS\Ocq.exe
O4 - HKCU\..\Run: [Veq] C:\WINDOWS\Bse.exe
O4 - HKCU\..\Run: [Fop] C:\WINDOWS\System32\Cbc.exe
O4 - HKCU\..\Run: [Plp] C:\WINDOWS\Ocm.exe
O4 - HKCU\..\Run: [Iko] C:\WINDOWS\Sas.exe
O4 - HKCU\..\Run: [Vbm] C:\WINDOWS\Fim.exe
O4 - HKCU\..\Run: [Gdi] C:\WINDOWS\System32\Eef.exe
O4 - HKCU\..\Run: [Gih] C:\WINDOWS\Ovj.exe
O4 - HKCU\..\Run: [Mmf] C:\WINDOWS\Nup.exe
O4 - HKCU\..\Run: [Jhj] C:\WINDOWS\Jpv.exe
O4 - HKCU\..\Run: [Bjs] C:\WINDOWS\System32\Kjk.exe
O4 - HKCU\..\Run: [Mbc] C:\WINDOWS\System32\Epi.exe
O4 - HKCU\..\Run: [Kic] C:\WINDOWS\Qms.exe
O4 - HKCU\..\Run: [Biq] C:\WINDOWS\System32\Udc.exe
O4 - HKCU\..\Run: [Unv] C:\WINDOWS\System32\Usu.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{BDC4963E-7478-4348-9A3B-FB2084C9B2D5}: NameServer = 165.21.83.88 165.21.100.88
O23 - Service: Intel® 82845G/GL/GE/PE/GV Graphics Controller Power Management (ialmpa) - Unknown owner - C:\WINDOWS\System32\pmsvc.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

SPSeHjfix Log:

(5/19/05 9:12:07 AM) SPSeHjFix started v1.1.2
(5/19/05 9:12:07 AM) OS: WinXP Service Pack 1 (5.1.2600)
(5/19/05 9:12:07 AM) Language: english
(5/19/05 9:12:07 AM) Win-Path: C:\WINDOWS
(5/19/05 9:12:07 AM) System-Path: C:\WINDOWS\System32
(5/19/05 9:12:07 AM) Temp-Path: C:\DOCUME~1\steven\LOCALS~1\Temp\
(5/19/05 9:12:11 AM) Disinfection started
(5/19/05 9:12:11 AM) Bad-Dll(IEP): c:\docume~1\steven\locals~1\temp\sp.dll
(5/19/05 9:12:11 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:12:11 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:12:11 AM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\steven\locals~1\temp\sp.dll/sp.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\steven\locals~1\temp\sp.dll/sp.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page:
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(5/19/05 9:12:11 AM) Stealth-String not found
(5/19/05 9:12:11 AM) No locked Files to delete. End without Reboot
(5/19/05 9:12:40 AM) Disinfection started
(5/19/05 9:12:40 AM) Bad-Dll(IEP): c:\docume~1\steven\locals~1\temp\sp.dll
(5/19/05 9:12:40 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:12:40 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:12:40 AM) Bad IE-pages: (none)
(5/19/05 9:12:40 AM) Stealth-String not found
(5/19/05 9:12:40 AM) No locked Files to delete. End without Reboot
(5/19/05 9:12:42 AM) Disinfection started
(5/19/05 9:12:42 AM) Bad-Dll(IEP): c:\docume~1\steven\locals~1\temp\sp.dll
(5/19/05 9:12:42 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:12:42 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:12:42 AM) Bad IE-pages: (none)
(5/19/05 9:12:42 AM) Stealth-String not found
(5/19/05 9:12:42 AM) No locked Files to delete. End without Reboot
(5/19/05 9:13:05 AM) Disinfection started
(5/19/05 9:13:05 AM) Bad-Dll(IEP): c:\docume~1\steven\locals~1\temp\sp.dll
(5/19/05 9:13:05 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:13:05 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:13:05 AM) Bad IE-pages: (none)
(5/19/05 9:13:05 AM) Stealth-String not found
(5/19/05 9:13:05 AM) No locked Files to delete. End without Reboot
(5/19/05 9:13:05 AM) Disinfection started
(5/19/05 9:13:05 AM) Bad-Dll(IEP): c:\docume~1\steven\locals~1\temp\sp.dll
(5/19/05 9:13:05 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:13:05 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:13:05 AM) Bad IE-pages: (none)
(5/19/05 9:13:05 AM) Stealth-String not found
(5/19/05 9:13:05 AM) No locked Files to delete. End without Reboot


(5/19/05 9:13:12 AM) SPSeHjFix started v1.1.2
(5/19/05 9:13:12 AM) OS: WinXP Service Pack 1 (5.1.2600)
(5/19/05 9:13:12 AM) Language: english
(5/19/05 9:13:12 AM) Win-Path: C:\WINDOWS
(5/19/05 9:13:12 AM) System-Path: C:\WINDOWS\System32
(5/19/05 9:13:12 AM) Temp-Path: C:\DOCUME~1\steven\LOCALS~1\Temp\
(5/19/05 9:13:14 AM) Disinfection started
(5/19/05 9:13:14 AM) Bad-Dll(IEP): (not found)
(5/19/05 9:13:14 AM) Bad-Dll(IEP) in BHO: (not found)
(5/19/05 9:13:14 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:13:14 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:13:14 AM) Bad IE-pages: (none)
(5/19/05 9:13:14 AM) Stealth-String not found
(5/19/05 9:13:14 AM) Not infected->END


(5/19/05 9:28:28 AM) SPSeHjFix started v1.1.2
(5/19/05 9:28:28 AM) OS: WinXP Service Pack 1 (5.1.2600)
(5/19/05 9:28:28 AM) Language: english
(5/19/05 9:28:28 AM) Win-Path: C:\WINDOWS
(5/19/05 9:28:28 AM) System-Path: C:\WINDOWS\System32
(5/19/05 9:28:28 AM) Temp-Path: C:\DOCUME~1\steven\LOCALS~1\Temp\
(5/19/05 9:28:30 AM) Disinfection started
(5/19/05 9:28:30 AM) Bad-Dll(IEP): (not found)
(5/19/05 9:28:30 AM) Bad-Dll(IEP) in BHO: (not found)
(5/19/05 9:28:30 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:28:30 AM) UBF: 7 - UBB: 1 - UBR: 74
(5/19/05 9:28:30 AM) Bad IE-pages: (none)
(5/19/05 9:28:30 AM) Stealth-String not found
(5/19/05 9:28:30 AM) Not infected->END


Now how do I get rid of those undesired 01 host listing and the supernews12-newsd32 listing in HJT log

rgds
Post #4
Looks like that took care of About:Blank. :)

Step 1
Download this file to your desktop.
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click on the deldomains.inf file and select Install.

Note : Since the Domains are deleted SpywareBlaster protection must be re-enabled, Spybot's Immunize feature must be used again, and you'll also have to re-install IE-SpyAd if installed.


Step 2
Click on this link http://www.downloads.subratam.org/KillBox.zip to download Pocket Killbox by Option^Explicit. Extract it from the zip file to the desktop. We will use this in a later step.


Step 3
Download and Save Spywadfix to your computer from this link:
http://www.thespykiller.co.uk/files/spywadfix.exe

Double click the file and it will automatically extract to c:\spywad where it needs to be to run. It will automatically open the remove spywad.vbs script for you. Select cancel.
If you have script blocking enabled you will get a warning about a malicious script wanting to run. Please allow this script to run.


Step 4
Open HijackThis, run a scan, then check the following:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

O2 - BHO: (no name) - {94D26C07-68A5-4BA6-9F78-0A72852D70B5} - C:\WINDOWS\System32\mhgmaaa.dll (file missing)
O2 - BHO: (no name) - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - (no file)

O4 - HKLM\..\Run: [msnmsgq32] C:\WINDOWS\msnmsgq.exe
O4 - HKLM\..\Run: [Vah] C:\WINDOWS\System32\Mem.exe
O4 - HKLM\..\Run: [Knt] C:\WINDOWS\Hsf.exe
O4 - HKLM\..\Run: [Ura] C:\WINDOWS\Ecp.exe
O4 - HKLM\..\Run: [Cdj] C:\WINDOWS\All.exe
O4 - HKLM\..\Run: [Ouk] C:\WINDOWS\System32\Kqb.exe
O4 - HKLM\..\Run: [Uvq] C:\WINDOWS\System32\Elr.exe
O4 - HKLM\..\Run: [Gon] C:\WINDOWS\System32\Hdr.exe
O4 - HKLM\..\Run: [Qur] C:\WINDOWS\System32\Apn.exe
O4 - HKLM\..\Run: [Mcr] C:\WINDOWS\System32\Svo.exe
O4 - HKLM\..\Run: [Nhi] C:\WINDOWS\Qsr.exe
O4 - HKLM\..\Run: [Jcc] C:\WINDOWS\Tpv.exe
O4 - HKLM\..\Run: [Ibs] C:\WINDOWS\Jbt.exe
O4 - HKLM\..\Run: [Drr] C:\WINDOWS\Bka.exe
O4 - HKLM\..\Run: [Alq] C:\WINDOWS\System32\Amn.exe
O4 - HKLM\..\Run: [Hqu] C:\WINDOWS\Ocq.exe
O4 - HKLM\..\Run: [Veq] C:\WINDOWS\Bse.exe
O4 - HKLM\..\Run: [Fop] C:\WINDOWS\System32\Cbc.exe
O4 - HKLM\..\Run: [Plp] C:\WINDOWS\Ocm.exe
O4 - HKLM\..\Run: [Iko] C:\WINDOWS\Sas.exe
O4 - HKLM\..\Run: [Vbm] C:\WINDOWS\Fim.exe
O4 - HKLM\..\Run: [Gdi] C:\WINDOWS\System32\Eef.exe
O4 - HKLM\..\Run: [Gih] C:\WINDOWS\Ovj.exe
O4 - HKLM\..\Run: [Mmf] C:\WINDOWS\Nup.exe
O4 - HKLM\..\Run: [Jhj] C:\WINDOWS\Jpv.exe
O4 - HKLM\..\Run: [Bjs] C:\WINDOWS\System32\Kjk.exe
O4 - HKLM\..\Run: [Mbc] C:\WINDOWS\System32\Epi.exe
O4 - HKLM\..\Run: [Kic] C:\WINDOWS\Qms.exe
O4 - HKLM\..\Run: [Biq] C:\WINDOWS\System32\Udc.exe
O4 - HKLM\..\Run: [Unv] C:\WINDOWS\System32\Usu.exe
O4 - HKLM\..\Run: [ccApp] C:\WINDOWS\NeroCheck.exe /i
O4 - HKLM\..\Run: [supernews12] C:\WINDOWS\newsd32.exe
O4 - HKCU\..\Run: [Vah] C:\WINDOWS\System32\Mem.exe
O4 - HKCU\..\Run: [Knt] C:\WINDOWS\Hsf.exe
O4 - HKCU\..\Run: [Ura] C:\WINDOWS\Ecp.exe
O4 - HKCU\..\Run: [Cdj] C:\WINDOWS\All.exe
O4 - HKCU\..\Run: [Ouk] C:\WINDOWS\System32\Kqb.exe
O4 - HKCU\..\Run: [Uvq] C:\WINDOWS\System32\Elr.exe
O4 - HKCU\..\Run: [Gon] C:\WINDOWS\System32\Hdr.exe
O4 - HKCU\..\Run: [Qur] C:\WINDOWS\System32\Apn.exe
O4 - HKCU\..\Run: [Mcr] C:\WINDOWS\System32\Svo.exe
O4 - HKCU\..\Run: [Nhi] C:\WINDOWS\Qsr.exe
O4 - HKCU\..\Run: [Jcc] C:\WINDOWS\Tpv.exe
O4 - HKCU\..\Run: [Ibs] C:\WINDOWS\Jbt.exe
O4 - HKCU\..\Run: [Drr] C:\WINDOWS\Bka.exe
O4 - HKCU\..\Run: [Alq] C:\WINDOWS\System32\Amn.exe
O4 - HKCU\..\Run: [Hqu] C:\WINDOWS\Ocq.exe
O4 - HKCU\..\Run: [Veq] C:\WINDOWS\Bse.exe
O4 - HKCU\..\Run: [Fop] C:\WINDOWS\System32\Cbc.exe
O4 - HKCU\..\Run: [Plp] C:\WINDOWS\Ocm.exe
O4 - HKCU\..\Run: [Iko] C:\WINDOWS\Sas.exe
O4 - HKCU\..\Run: [Vbm] C:\WINDOWS\Fim.exe
O4 - HKCU\..\Run: [Gdi] C:\WINDOWS\System32\Eef.exe
O4 - HKCU\..\Run: [Gih] C:\WINDOWS\Ovj.exe
O4 - HKCU\..\Run: [Mmf] C:\WINDOWS\Nup.exe
O4 - HKCU\..\Run: [Jhj] C:\WINDOWS\Jpv.exe
O4 - HKCU\..\Run: [Bjs] C:\WINDOWS\System32\Kjk.exe
O4 - HKCU\..\Run: [Mbc] C:\WINDOWS\System32\Epi.exe
O4 - HKCU\..\Run: [Kic] C:\WINDOWS\Qms.exe
O4 - HKCU\..\Run: [Biq] C:\WINDOWS\System32\Udc.exe
O4 - HKCU\..\Run: [Unv] C:\WINDOWS\System32\Usu.exe

With all other programs and browsers closed, click fix checked.


Step 5
Double-click on Killbox.exe to start the program. Select the Delete on Reboot option.
In the field labeled Full Path of File to Delete enter the file paths listed below ONE AT A TIME (EXACTLY as it appears, please double check to make sure!):

O4 - HKLM\..\Run: [msnmsgq32] C:\WINDOWS\msnmsgq.exe
O4 - HKLM\..\Run: [Vah] C:\WINDOWS\System32\Mem.exe
O4 - HKLM\..\Run: [Knt] C:\WINDOWS\Hsf.exe
O4 - HKLM\..\Run: [Ura] C:\WINDOWS\Ecp.exe
O4 - HKLM\..\Run: [Cdj] C:\WINDOWS\All.exe
O4 - HKLM\..\Run: [Ouk] C:\WINDOWS\System32\Kqb.exe
O4 - HKLM\..\Run: [Uvq] C:\WINDOWS\System32\Elr.exe
O4 - HKLM\..\Run: [Gon] C:\WINDOWS\System32\Hdr.exe
O4 - HKLM\..\Run: [Qur] C:\WINDOWS\System32\Apn.exe
O4 - HKLM\..\Run: [Mcr] C:\WINDOWS\System32\Svo.exe
O4 - HKLM\..\Run: [Nhi] C:\WINDOWS\Qsr.exe
O4 - HKLM\..\Run: [Jcc] C:\WINDOWS\Tpv.exe
O4 - HKLM\..\Run: [Ibs] C:\WINDOWS\Jbt.exe
O4 - HKLM\..\Run: [Drr] C:\WINDOWS\Bka.exe
O4 - HKLM\..\Run: [Alq] C:\WINDOWS\System32\Amn.exe
O4 - HKLM\..\Run: [Hqu] C:\WINDOWS\Ocq.exe
O4 - HKLM\..\Run: [Veq] C:\WINDOWS\Bse.exe
O4 - HKLM\..\Run: [Fop] C:\WINDOWS\System32\Cbc.exe
O4 - HKLM\..\Run: [Plp] C:\WINDOWS\Ocm.exe
O4 - HKLM\..\Run: [Iko] C:\WINDOWS\Sas.exe
O4 - HKLM\..\Run: [Vbm] C:\WINDOWS\Fim.exe
O4 - HKLM\..\Run: [Gdi] C:\WINDOWS\System32\Eef.exe
O4 - HKLM\..\Run: [Gih] C:\WINDOWS\Ovj.exe
O4 - HKLM\..\Run: [Mmf] C:\WINDOWS\Nup.exe
O4 - HKLM\..\Run: [Jhj] C:\WINDOWS\Jpv.exe
O4 - HKLM\..\Run: [Bjs] C:\WINDOWS\System32\Kjk.exe
O4 - HKLM\..\Run: [Mbc] C:\WINDOWS\System32\Epi.exe
O4 - HKLM\..\Run: [Kic] C:\WINDOWS\Qms.exe
O4 - HKLM\..\Run: [Biq] C:\WINDOWS\System32\Udc.exe
O4 - HKLM\..\Run: [Unv] C:\WINDOWS\System32\Usu.exe
O4 - HKLM\..\Run: [ccApp] C:\WINDOWS\NeroCheck.exe /i
O4 - HKLM\..\Run: [supernews12] C:\WINDOWS\newsd32.exe
O4 - HKCU\..\Run: [Vah] C:\WINDOWS\System32\Mem.exe
O4 - HKCU\..\Run: [Knt] C:\WINDOWS\Hsf.exe
O4 - HKCU\..\Run: [Ura] C:\WINDOWS\Ecp.exe
O4 - HKCU\..\Run: [Cdj] C:\WINDOWS\All.exe
O4 - HKCU\..\Run: [Ouk] C:\WINDOWS\System32\Kqb.exe
O4 - HKCU\..\Run: [Uvq] C:\WINDOWS\System32\Elr.exe
O4 - HKCU\..\Run: [Gon] C:\WINDOWS\System32\Hdr.exe
O4 - HKCU\..\Run: [Qur] C:\WINDOWS\System32\Apn.exe
O4 - HKCU\..\Run: [Mcr] C:\WINDOWS\System32\Svo.exe
O4 - HKCU\..\Run: [Nhi] C:\WINDOWS\Qsr.exe
O4 - HKCU\..\Run: [Jcc] C:\WINDOWS\Tpv.exe
O4 - HKCU\..\Run: [Ibs] C:\WINDOWS\Jbt.exe
O4 - HKCU\..\Run: [Drr] C:\WINDOWS\Bka.exe
O4 - HKCU\..\Run: [Alq] C:\WINDOWS\System32\Amn.exe
O4 - HKCU\..\Run: [Hqu] C:\WINDOWS\Ocq.exe
O4 - HKCU\..\Run: [Veq] C:\WINDOWS\Bse.exe
O4 - HKCU\..\Run: [Fop] C:\WINDOWS\System32\Cbc.exe
O4 - HKCU\..\Run: [Plp] C:\WINDOWS\Ocm.exe
O4 - HKCU\..\Run: [Iko] C:\WINDOWS\Sas.exe
O4 - HKCU\..\Run: [Vbm] C:\WINDOWS\Fim.exe
O4 - HKCU\..\Run: [Gdi] C:\WINDOWS\System32\Eef.exe
O4 - HKCU\..\Run: [Gih] C:\WINDOWS\Ovj.exe
O4 - HKCU\..\Run: [Mmf] C:\WINDOWS\Nup.exe
O4 - HKCU\..\Run: [Jhj] C:\WINDOWS\Jpv.exe
O4 - HKCU\..\Run: [Bjs] C:\WINDOWS\System32\Kjk.exe
O4 - HKCU\..\Run: [Mbc] C:\WINDOWS\System32\Epi.exe
O4 - HKCU\..\Run: [Kic] C:\WINDOWS\Qms.exe
O4 - HKCU\..\Run: [Biq] C:\WINDOWS\System32\Udc.exe
O4 - HKCU\..\Run: [Unv] C:\WINDOWS\System32\Usu.exe

Press the button that looks like a red circle with a white X in it after each one. When it asks if you would like to delete on reboot, press the YES button, when it asks if you want to reboot now, press the NO button. Do this after each one until you have entered the LAST file path I have listed above. After that LAST file path has been entered, press the YES button at both prompts so that your computer restarts.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


Step 6
You will need to do this step for every user account on the computer.

After the reboot go to the C:\Spywad folder. Inside the folder, double click on Other Profiles Regfix.vbs

Explorer will be ended and your user's active desktop registry entries will be repaired. Explorer will be restarted.

To reset your wallpaper, open Display Properties > Desktop Tab. Choose a Wallpaper and apply. Close Display Properties.


Step 7
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.
Post #5
OK Alan - done as per instructions , new log attached , computer behaving normally as of now , just a little sluggish at times.

Logfile of HijackThis v1.99.1
Scan saved at 7:09:59 PM, on 5/21/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft SQL Server\MSSQL$SOPHOS\Binn\sqlservr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TSC.EXE
C:\Documents and Settings\steven\Desktop\HJT & malware\HijackThis- careful do not click this.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
O1 - Hosts: 127.0.0.3 iframeprofit.com
O1 - Hosts: 127.0.0.3 www.iframeprofit.com
O1 - Hosts: 127.0.0.3 www.loadcash.biz
O1 - Hosts: 127.0.0.3 loadcash.biz
O1 - Hosts: 127.0.0.3 traffic2cash.biz
O1 - Hosts: 127.0.0.3 www.traffic2cash.biz
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 www.iframedollars.biz
O1 - Hosts: 127.0.0.3 iframedollars.biz
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
O1 - Hosts: 127.0.0.3 x.full-tgp.net
O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
O1 - Hosts: 127.0.0.3 autoescrowpay.com
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Intel® 82845G/GL/GE/PE/GV Graphics Controller Power Management (ialmpa) - Unknown owner - C:\WINDOWS\System32\pmsvc.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

rgds
Post #6
Download the Hoster from here.
  • Unzip the contents of hoster.zip.
  • Double click on hoster.exe to run the program.
  • Press "Restore Original Hosts" and press "OK".
  • Exit Program.
Click here to download mwavscan.
  • Double-click it to run it.
  • Read then accept the agreement.
  • Check Drive, and select all local drives, scan all files, then press 'scan'. (This may take a while and will not fix anything)
  • Once it finds something, it will prompt you so click OK.
  • When it is completed, anything found will be displayed in the lower pane.
  • Highlight it, copy it (CTRL+C), and paste (CTRL+V) it in your next reply.
Reboot normally and post a fresh Hijackthis log. Include the mwavscan.
Post #7
OK Done as per instructions , attached HJT latest log - and mwav log as well :

Logfile of HijackThis v1.99.1
Scan saved at 4:53:56 PM, on 5/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\steven\Desktop\HJT & malware\HijackThis- careful do not click this.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Intel® 82845G/GL/GE/PE/GV Graphics Controller Power Management (ialmpa) - Unknown owner - C:\WINDOWS\System32\pmsvc.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\REGOBJ.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00000000-6CB0-410C-8C3D-8FA8D2011D0A}" refers to invalid object "C:\Program Files\iMesh\iMesh5\iMeshBHO.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{025F0828-520C-4237-BE67-1CDCB18395D5}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{02E389CB-7FD5-407B-9622-3E229C2E3993}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0944D16C-D0F4-4389-982A-A085595A9EB3}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0FD95BFE-8321-11D2-B10D-00805F88185D}" refers to invalid object "C:\PROGRA~1\ACAD2000\express\axrtext.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{11DD4A33-BB11-46B8-8BAF-8FDD322C444F}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{163955B9-B4D8-41C0-9506-DF87C8874833}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{19658F50-BC67-4A43-ADB9-6BF368CD8488}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1D6A33F4-DA26-4ED9-A72D-B6C2A3C7C1BE}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{241C21E3-D814-49E8-9FCD-961E0ECAF3E2}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2aa2b5fe-b846-4d07-810c-b21ee45320e3}" refers to invalid object "%SystemRoot%\System32\xmlprovi.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2AD750D2-FBAA-44DE-B2C8-EA70AA1BC770}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2CDB6749-F14C-446F-9852-747AAD75B805}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3831331E-0D11-4716-871D-68F3B11D23C9}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3DCD2BC5-8489-48AE-891F-90C8B2F19F56}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3E92C53C-C8A9-40D2-82B2-CEA59E45C6CB}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3FD730D1-9DD5-4AE8-9857-F12F06CFFD2A}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{40B4DD9D-83C1-11D2-B340-0060B0B3B2E6}" refers to invalid object "C:\PROGRA~1\ACAD2000\express\axctextapp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{41600CBD-0A19-11D2-B54A-080009D023F9}" refers to invalid object "C:\PROGRA~1\ACAD2000\shapes.arx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{42AB8D08-F741-4166-8A0D-3C1A50B43F93}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\GnucCOM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{42F7324B-B32A-4734-8F8A-C820443EC948}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{464BA7B8-520A-484A-B4F6-609C4A76AD2B}" refers to invalid object "C:\WINDOWS\System32\pppnaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{46814717-161A-46F1-9D4E-D7B34017877C}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{498E125B-004C-4F46-9AED-EC3D9D807683}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5224C8FC-ECAC-4C19-AA12-AE322BFEEC13}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{52C01A76-19E2-4A50-AE8A-38FFBCCF9182}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{53E05B28-A7CD-4DC7-A1B7-4786862F976E}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{55EA37B6-5D8A-4BA0-B3FF-9B3B57F1ACB0}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{56336BCA-3D8A-11d6-A00B-0050DA18DE71}" refers to invalid object "C:\DOCUME~1\steven\LOCALS~1\Temp\InfoWindow.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{566B6631-0096-4CA2-B2BD-FC27CA65684E}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5954EA75-9BFA-461A-BD34-CEA3A861FF19}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}" refers to invalid object "C:\WINDOWS\System32\twext.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{59813F2D-5AA1-4C57-9B84-A928639AF157}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5A45F9E3-54A0-4B10-B642-725928B8FD51}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5AAF5475-1102-4DF2-889C-D803047B14AA}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5B65AF81-D3A0-4B96-AE28-53FB538F4BBC}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5CE53745-5040-4B0F-96C4-37973AF0ECDE}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5DAB01A0-C479-4DAE-97CF-6D928AC2DF01}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5EAA54AB-6601-40E4-A13F-01559500D2C7}" refers to invalid object "C:\Program Files\iMesh\iMesh5\searchMesh.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5F3FDC91-FA3C-4ECD-BFF0-2E4527769D75}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{60D0ABB3-404F-4445-9567-3F47558662F5}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{684345E8-49F5-4C83-92B7-648CFECA443C}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{72C95A4D-E126-4D50-97A2-3C21BB5AFC8B}" refers to invalid object "C:\WINDOWS\System32\pppnaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{740C3B30-4E79-4581-9F2F-8918599BD673}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{75BA43D6-1C7C-4D76-B75D-6753D58841D3}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{762EC429-1A5D-4AB8-844A-9A552E1241DA}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{78A6BF3D-3059-4481-BA57-443C007E1785}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8016B1B6-E6A1-4454-9EEE-07AE17D308E3}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8076BC70-751C-4BE5-A120-01BE19FB63FE}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{87B157B0-7EB8-4869-88B5-D6C67D5C46E0}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{948BD7F7-1DBE-4080-B013-7661927E154A}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{953F0A35-055D-4223-AE19-BF77861EBC4D}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{963551BE-53D6-4D5B-A7D7-30A9EFF1E539}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{96919A10-6AD0-4C08-AE6B-289C1D3913A3}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{988FFDFB-7801-430D-A3D3-245FFD21CA6D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9DB7A13C-F208-4981-8353-73CC61AE2783}" refers to invalid object "C:\WINDOWS\System32\twext.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A4E6C18C-9A96-4A63-AAE3-2E5B250CEAD0}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A506EF88-9EFC-4522-BFE1-A8E886A64D80}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A5704C37-40DA-49EF-904B-97E5F5F9B1C5}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A5E97FBA-B32C-49C4-8298-22C50399F918}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A8D79E06-0CF9-4FCD-A516-F3A196B7EE3C}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AC757038-67D5-4279-9F42-970241693AA0}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AE369A29-85C5-4209-A0A0-C11C8807005E}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B0244E17-9371-42EF-A942-AD94565C2D30}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B1143F99-C612-4647-9D7A-7FC269278EB2}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B3647401-DCAD-4B7F-900E-4E37B4BF5283}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B3F948C3-53A2-48F4-8A81-E9DFE79E1B27}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B87799AF-2CE9-4DAA-93CF-65F002035369}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BBC73C94-337C-43CC-B52C-31EB9FA34013}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C017460E-5BAA-4EAC-8B7D-D76E93F1352D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C406F816-318D-4F7D-81CB-BA93CA7B70D5}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C4ED76AB-5BE2-4B92-A502-C7272B18E2E9}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C708C589-6563-4ACB-AF3B-522648E4DD7D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C8B80674-5F31-41F2-AD78-DA531A00AE8A}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C9668AE4-4DAA-4618-B0B1-5CD333D111F6}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D3E23E38-9A4D-4BCB-B05A-7028330157AB}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D502D4A3-03E6-4EAE-A14E-69606CA63430}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DD2A07A0-F5A8-45B8-BA4F-51887CF4589A}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E4945DEA-7750-4778-A9C9-F8A903D22704}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E6E54979-1750-487B-93A9-8F0CAF31C5A8}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E9A6464C-8653-4366-BD80-C4B5B4956AC4}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EB98940B-9D3E-48D6-AEB7-72910DB95721}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EC22770D-3343-4C56-8A8D-3E560475F655}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ED82B2C2-6786-4A92-B2B3-D694B508364D}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F0FAEDFA-DCF6-4627-B172-17EC72A87603}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F65C9AE8-1E60-492C-9C48-CD895C644184}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F86D575F-5D50-4543-AF5E-7A8736768CDB}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F97A6C5F-E59D-4467-A026-AA7A0D6B1F11}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FD19E70C-9F2D-4CE5-9E76-13BD45FBAFD8}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FE014943-7E6A-4ADD-9FB4-1FA6CF0A06D9}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\RegObj.Registry" refers to invalid object "{C55A1680-CD5A-11CF-8D29-444553540000}". Action Taken: No Action Taken.
Entry "HKCR\RegObj.Registry.1" refers to invalid object "{C55A1680-CD5A-11CF-8D29-444553540000}". Action Taken: No Action Taken.
Entry "HKCR\Shutterfly.UploaderCtrl.2.0.3.0" refers to invalid object "{9600F64D-755F-11D4-A47F-0001023E6D5A}". Action Taken: No Action Taken.
Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
File C:\WINDOWS\Agn.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Aip.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Bup.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Cot.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Grp.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Hdg.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\lbbho.dll tagged as "not-a-virus:AdWare.ToolBar.Neon.a". Action Taken: No Action Taken.
File C:\WINDOWS\Lse.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\NDNuninstall4_85.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\WINDOWS\NDNuninstall6_38.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\WINDOWS\newsd32.exe infected by "Trojan-Downloader.Win32.Agent.is" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Nla.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Req.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Rnq.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Snt.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Ucc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Uiu.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Vvc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\winagent.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\System32\vxh8jkdq8.exe infected by "Trojan-Downloader.Win32.Small.hx" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\System32\web.exe infected by "Trojan-Downloader.Win32.Agent.km" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\steven\LOCALS~1\Temp\de02600d.exe infected by "Trojan-Downloader.Win32.Swizzor.bn" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\steven\LOCALS~1\Temp\sp.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
File C:\DOCUME~1\steven\LOCALS~1\Temp\sta10E.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken.
File C:\DOCUME~1\steven\LOCALS~1\Temp\uninstall.exe tagged as "not-a-virus:AdWare.ToolBar.EliteBar.q". Action Taken: No Action Taken.
File C:\DOCUME~1\steven\LOCALS~1\Temp\vx2.game infected by "Trojan-Dropper.Win32.Small.zg" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BackWeblite1.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SearchMiracle2.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\TIBS.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\TIBS6.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Grace\Local Settings\Temporary Internet Files\Content.IE5\UELQ2V2S\dl[1].exe infected by "Trojan-Downloader.Win32.Agent.il" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\steven\Desktop\setup_ares.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\Documents and Settings\steven\Local Settings\Temp\de02600d.exe infected by "Trojan-Downloader.Win32.Swizzor.bn" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\steven\Local Settings\Temp\sp.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
File C:\Documents and Settings\steven\Local Settings\Temp\sta10E.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken.
File C:\Documents and Settings\steven\Local Settings\Temp\uninstall.exe tagged as "not-a-virus:AdWare.ToolBar.EliteBar.q". Action Taken: No Action Taken.
File C:\Documents and Settings\steven\Local Settings\Temp\vx2.game infected by "Trojan-Dropper.Win32.Small.zg" Virus! Action Taken: No Action Taken.
File C:\Program Files\ACAD2000\migration\pictaker\PTEEEval.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\burn4free_setup.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\Program Files\setup_ares.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\Internet Security 2005\Quarantine\1F.tmp infected by "Trojan-Clicker.Win32.Spywad.e" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\Internet Security 2005\Quarantine\21.tmp infected by "Trojan-Clicker.Win32.Spywad.e" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\Internet Security 2005\Quarantine\23.tmp infected by "Trojan-Clicker.Win32.Spywad.e" Virus! Action Taken: No Action Taken.
File C:\Program Files\Trend Micro\Internet Security 2005\Quarantine\25.tmp infected by "Trojan-Clicker.Win32.Spywad.e" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP288\A0052873.exe tagged as not-a-virus:RiskWare.Proxy.MarketScore.f. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP301\A0053027.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP301\A0053034.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP301\A0053046.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP301\A0053047.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053053.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053062.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053238.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053319.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053332.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP303\A0053347.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP303\A0054404.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP303\A0054406.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP303\A0054413.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP304\A0054424.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP321\A0054659.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP321\A0054747.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP321\A0054754.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP322\A0054760.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP322\A0054769.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP322\A0054777.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP322\A0054786.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP323\A0054814.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP323\A0054823.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP325\A0054982.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP326\A0055005.dll tagged as "not-a-virus:AdWare.ToolBar.Neon.a". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP326\A0055007.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP328\A0055023.DLL tagged as "not-a-virus:AdWare.Toolbar.MyWay.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055029.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055046.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055082.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055099.DLL tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055114.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP332\A0055140.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP332\A0055144.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP332\A0055156.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP333\A0055160.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP334\A0055171.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP336\A0055201.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP336\A0055202.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055231.DLL tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055234.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055245.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055246.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055258.DLL tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055259.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055300.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055301.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055307.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055315.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055316.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055317.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP340\A0055324.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP340\A0055333.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP340\A0055334.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP340\A0055335.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP341\A0055348.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP341\A0055357.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP341\A0055358.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP341\A0055359.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055366.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055367.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055371.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055372.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055384.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055432.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055433.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055434.exe infected by "Trojan-Downloader.Win32.Agent.is" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055435.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055520.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055523.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055526.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057364.dll tagged as "not-a-virus:AdWare.Coreak". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057379.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057382.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057383.exe tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057434.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057653.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP359\A0058075.dll infected by "Backdoor.Win32.Agent.iw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP359\A0058096.dll infected by "Backdoor.Win32.Agent.iw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP359\A0058110.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP360\A0058126.DLL tagged as "not-a-virus:AdWare.Toolbar.MyWay.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP361\A0058152.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP361\A0059173.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP362\A0059309.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP362\A0059346.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP362\A0059354.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059609.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060480.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060484.dll infected by "Backdoor.Win32.Agent.iw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060491.dll infected by "Trojan.Win32.Agent.co" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060759.exe infected by "Trojan-Downloader.Win32.Agent.km" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060760.exe tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060761.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060774.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP369\A0060873.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062458.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062719.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062761.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062768.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062790.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP371\A0062879.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP371\A0062908.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP372\A0062955.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP372\A0062961.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP373\A0062977.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP373\A0063017.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP374\A0063067.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP374\A0063130.dll tagged as "not-a-virus:AdWare.NavExcel.g". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP375\A0063174.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP375\A0063197.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP375\A0063224.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063253.dll tagged as "not-a-virus:AdWare.NavExcel.f". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063254.exe tagged as "not-a-virus:AdWare.NavExcel". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063255.exe tagged as "not-a-virus:AdWare.NavExcel.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063256.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063257.exe tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063258.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063270.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063290.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063314.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP377\A0063340.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP377\A0063341.exe infected by "Trojan-Downloader.Win32.Agent.is" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP377\A0063362.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP378\A0063381.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP379\A0063428.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP379\A0063465.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP380\A0063499.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP380\A0063525.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP380\A0063551.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP381\A0063579.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP381\A0063608.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP382\A0063614.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP382\A0063616.dll tagged as not-a-virus:RiskWare.Proxy.MarketScode.c. No Action Taken.
File C:\WINDOWS\Agn.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Aip.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Bup.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Cot.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Grp.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Hdg.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\isrvs\isearch.xpi tagged as "not-a-virus:AdWare.ToolBar.ISearch.e". Action Taken: No Action Taken.
File C:\WINDOWS\lbbho.dll tagged as "not-a-virus:AdWare.ToolBar.Neon.a". Action Taken: No Action Taken.
File C:\WINDOWS\Lse.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\NDNuninstall4_85.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\WINDOWS\NDNuninstall6_38.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\WINDOWS\newsd32.exe infected by "Trojan-Downloader.Win32.Agent.is" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Nla.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Req.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Rnq.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Snt.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system\svchost.exe infected by "Trojan-Dropper.Win32.Small.zg" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\drivers\etc\hosts.bak i
Post #8
Many of the items are in System Restore. We will fix these once the computer is clean.

Download CCleaner from here to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • Click Run Cleaner to run the program.
  • Caution : I do not recommend using the 'Issues' tab as it is known to find false positives.
  • After it has completed it's process, click Exit.

You have Ares on your computer. This program comes bundled with malware. I recommend removing it with Add/Remove Programs. You can read about it here and also find links to clean file sharing programs.

Now let's clean up the Spybot S&D backups. Open Spybot S&D, click Recovery and check all items. Now click Purge and OK the message that appears.


Clean all quarantined items from within Trend Micro Antivirus. I don't have this program so I'm not sure of the exact process for this.


Start Killbox and click on Tools < Delete Temp Files. When that finishes, copy and paste each of the following lines into the Full Path of File to Delete box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\WINDOWS\Agn.html
C:\WINDOWS\Aip.html
C:\WINDOWS\Bup.html
C:\WINDOWS\Cot.html
C:\WINDOWS\Grp.html
C:\WINDOWS\Hdg.html
C:\WINDOWS\lbbho.dll
C:\WINDOWS\Lse.html
C:\WINDOWS\NDNuninstall4_85.exe
C:\WINDOWS\NDNuninstall6_38.exe
C:\WINDOWS\newsd32.exe
C:\WINDOWS\Nla.html
C:\WINDOWS\Req.html
C:\WINDOWS\Rnq.html
C:\WINDOWS\Snt.html
C:\WINDOWS\Ucc.html
C:\WINDOWS\Uiu.html
C:\WINDOWS\Vvc.html
C:\WINDOWS\winagent.exe
C:\WINDOWS\System32\vxh8jkdq8.exe
C:\WINDOWS\System32\web.exe
C:\Program Files\burn4free_setup.exe
C:\WINDOWS\isrvs\isearch.xpi
C:\WINDOWS\system\svchost.exe

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


After reboot, post a new mwavscan log and a fresh Hijackthis log.
Post #9
These are the new HJTlog and mwavlog :

HJT -
Logfile of HijackThis v1.99.1
Scan saved at 4:53:56 PM, on 5/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\steven\Desktop\HJT & malware\HijackThis- careful do not click this.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Intel® 82845G/GL/GE/PE/GV Graphics Controller Power Management (ialmpa) - Unknown owner - C:\WINDOWS\System32\pmsvc.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe


MWAV -
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\REGOBJ.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00000000-6CB0-410C-8C3D-8FA8D2011D0A}" refers to invalid object "C:\Program Files\iMesh\iMesh5\iMeshBHO.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{025F0828-520C-4237-BE67-1CDCB18395D5}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{02E389CB-7FD5-407B-9622-3E229C2E3993}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0944D16C-D0F4-4389-982A-A085595A9EB3}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0FD95BFE-8321-11D2-B10D-00805F88185D}" refers to invalid object "C:\PROGRA~1\ACAD2000\express\axrtext.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{11DD4A33-BB11-46B8-8BAF-8FDD322C444F}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{163955B9-B4D8-41C0-9506-DF87C8874833}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{19658F50-BC67-4A43-ADB9-6BF368CD8488}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1D6A33F4-DA26-4ED9-A72D-B6C2A3C7C1BE}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{241C21E3-D814-49E8-9FCD-961E0ECAF3E2}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2aa2b5fe-b846-4d07-810c-b21ee45320e3}" refers to invalid object "%SystemRoot%\System32\xmlprovi.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2AD750D2-FBAA-44DE-B2C8-EA70AA1BC770}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2CDB6749-F14C-446F-9852-747AAD75B805}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3831331E-0D11-4716-871D-68F3B11D23C9}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3DCD2BC5-8489-48AE-891F-90C8B2F19F56}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3E92C53C-C8A9-40D2-82B2-CEA59E45C6CB}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3FD730D1-9DD5-4AE8-9857-F12F06CFFD2A}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{40B4DD9D-83C1-11D2-B340-0060B0B3B2E6}" refers to invalid object "C:\PROGRA~1\ACAD2000\express\axctextapp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{41600CBD-0A19-11D2-B54A-080009D023F9}" refers to invalid object "C:\PROGRA~1\ACAD2000\shapes.arx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{42AB8D08-F741-4166-8A0D-3C1A50B43F93}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\GnucCOM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{42F7324B-B32A-4734-8F8A-C820443EC948}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{464BA7B8-520A-484A-B4F6-609C4A76AD2B}" refers to invalid object "C:\WINDOWS\System32\pppnaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{46814717-161A-46F1-9D4E-D7B34017877C}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{498E125B-004C-4F46-9AED-EC3D9D807683}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5224C8FC-ECAC-4C19-AA12-AE322BFEEC13}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{52C01A76-19E2-4A50-AE8A-38FFBCCF9182}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{53E05B28-A7CD-4DC7-A1B7-4786862F976E}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{55EA37B6-5D8A-4BA0-B3FF-9B3B57F1ACB0}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{56336BCA-3D8A-11d6-A00B-0050DA18DE71}" refers to invalid object "C:\DOCUME~1\steven\LOCALS~1\Temp\InfoWindow.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{566B6631-0096-4CA2-B2BD-FC27CA65684E}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5954EA75-9BFA-461A-BD34-CEA3A861FF19}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}" refers to invalid object "C:\WINDOWS\System32\twext.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{59813F2D-5AA1-4C57-9B84-A928639AF157}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5A45F9E3-54A0-4B10-B642-725928B8FD51}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5AAF5475-1102-4DF2-889C-D803047B14AA}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5B65AF81-D3A0-4B96-AE28-53FB538F4BBC}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5CE53745-5040-4B0F-96C4-37973AF0ECDE}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5DAB01A0-C479-4DAE-97CF-6D928AC2DF01}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5EAA54AB-6601-40E4-A13F-01559500D2C7}" refers to invalid object "C:\Program Files\iMesh\iMesh5\searchMesh.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5F3FDC91-FA3C-4ECD-BFF0-2E4527769D75}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{60D0ABB3-404F-4445-9567-3F47558662F5}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{684345E8-49F5-4C83-92B7-648CFECA443C}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{72C95A4D-E126-4D50-97A2-3C21BB5AFC8B}" refers to invalid object "C:\WINDOWS\System32\pppnaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{740C3B30-4E79-4581-9F2F-8918599BD673}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{75BA43D6-1C7C-4D76-B75D-6753D58841D3}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{762EC429-1A5D-4AB8-844A-9A552E1241DA}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{78A6BF3D-3059-4481-BA57-443C007E1785}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8016B1B6-E6A1-4454-9EEE-07AE17D308E3}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8076BC70-751C-4BE5-A120-01BE19FB63FE}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{87B157B0-7EB8-4869-88B5-D6C67D5C46E0}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{948BD7F7-1DBE-4080-B013-7661927E154A}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{953F0A35-055D-4223-AE19-BF77861EBC4D}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{963551BE-53D6-4D5B-A7D7-30A9EFF1E539}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{96919A10-6AD0-4C08-AE6B-289C1D3913A3}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{988FFDFB-7801-430D-A3D3-245FFD21CA6D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9A8BC2FF-D9FE-4A2F-8DB3-3389FA4A4730}" refers to invalid object "C:\WINDOWS\lbbho.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9DB7A13C-F208-4981-8353-73CC61AE2783}" refers to invalid object "C:\WINDOWS\System32\twext.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A4E6C18C-9A96-4A63-AAE3-2E5B250CEAD0}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A506EF88-9EFC-4522-BFE1-A8E886A64D80}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A5704C37-40DA-49EF-904B-97E5F5F9B1C5}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A5E97FBA-B32C-49C4-8298-22C50399F918}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A8D79E06-0CF9-4FCD-A516-F3A196B7EE3C}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AC757038-67D5-4279-9F42-970241693AA0}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AE369A29-85C5-4209-A0A0-C11C8807005E}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B0244E17-9371-42EF-A942-AD94565C2D30}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B1143F99-C612-4647-9D7A-7FC269278EB2}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B3647401-DCAD-4B7F-900E-4E37B4BF5283}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B3F948C3-53A2-48F4-8A81-E9DFE79E1B27}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B87799AF-2CE9-4DAA-93CF-65F002035369}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BBC73C94-337C-43CC-B52C-31EB9FA34013}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C017460E-5BAA-4EAC-8B7D-D76E93F1352D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C406F816-318D-4F7D-81CB-BA93CA7B70D5}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C4ED76AB-5BE2-4B92-A502-C7272B18E2E9}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C708C589-6563-4ACB-AF3B-522648E4DD7D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C8B80674-5F31-41F2-AD78-DA531A00AE8A}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C9668AE4-4DAA-4618-B0B1-5CD333D111F6}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D3E23E38-9A4D-4BCB-B05A-7028330157AB}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D502D4A3-03E6-4EAE-A14E-69606CA63430}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DD2A07A0-F5A8-45B8-BA4F-51887CF4589A}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E4945DEA-7750-4778-A9C9-F8A903D22704}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E6E54979-1750-487B-93A9-8F0CAF31C5A8}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E9A6464C-8653-4366-BD80-C4B5B4956AC4}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EB98940B-9D3E-48D6-AEB7-72910DB95721}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EC22770D-3343-4C56-8A8D-3E560475F655}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ED82B2C2-6786-4A92-B2B3-D694B508364D}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F0FAEDFA-DCF6-4627-B172-17EC72A87603}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F65C9AE8-1E60-492C-9C48-CD895C644184}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F86D575F-5D50-4543-AF5E-7A8736768CDB}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F97A6C5F-E59D-4467-A026-AA7A0D6B1F11}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FD19E70C-9F2D-4CE5-9E76-13BD45FBAFD8}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FE014943-7E6A-4ADD-9FB4-1FA6CF0A06D9}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken.
Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\RegObj.Registry" refers to invalid object "{C55A1680-CD5A-11CF-8D29-444553540000}". Action Taken: No Action Taken.
Entry "HKCR\RegObj.Registry.1" refers to invalid object "{C55A1680-CD5A-11CF-8D29-444553540000}". Action Taken: No Action Taken.
Entry "HKCR\Shutterfly.UploaderCtrl.2.0.3.0" refers to invalid object "{9600F64D-755F-11D4-A47F-0001023E6D5A}". Action Taken: No Action Taken.
Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
File C:\!Submit\Agn.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Aip.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Bup.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\burn4free_setup.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\!Submit\Cot.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Grp.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Hdg.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\isearch.xpi tagged as "not-a-virus:AdWare.ToolBar.ISearch.e". Action Taken: No Action Taken.
File C:\!Submit\lbbho.dll tagged as "not-a-virus:AdWare.ToolBar.Neon.a". Action Taken: No Action Taken.
File C:\!Submit\Lse.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\NDNuninstall4_85.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\!Submit\NDNuninstall6_38.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\!Submit\newsd32.exe infected by "Trojan-Downloader.Win32.Agent.is" Virus! Action Taken: No Action Taken.
File C:\!Submit\Nla.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Req.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Rnq.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Snt.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\svchost.exe infected by "Trojan-Dropper.Win32.Small.zg" Virus! Action Taken: No Action Taken.
File C:\!Submit\Ucc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Uiu.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\Vvc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken.
File C:\!Submit\vxh8jkdq8.exe infected by "Trojan-Downloader.Win32.Small.hx" Virus! Action Taken: No Action Taken.
File C:\!Submit\web.exe infected by "Trojan-Downloader.Win32.Agent.km" Virus! Action Taken: No Action Taken.
File C:\!Submit\winagent.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Grace\Local Settings\Temporary Internet Files\Content.IE5\UELQ2V2S\dl[1].exe infected by "Trojan-Downloader.Win32.Agent.il" Virus! Action Taken: No Action Taken.
File C:\Program Files\ACAD2000\migration\pictaker\PTEEEval.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\setup_ares.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP288\A0052873.exe tagged as not-a-virus:RiskWare.Proxy.MarketScore.f. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP301\A0053027.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP301\A0053034.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP301\A0053046.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP301\A0053047.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053053.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053062.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053238.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053319.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP302\A0053332.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP303\A0053347.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP303\A0054404.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP303\A0054406.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP303\A0054413.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP304\A0054424.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP321\A0054659.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP321\A0054747.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP321\A0054754.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP322\A0054760.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP322\A0054769.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP322\A0054777.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP322\A0054786.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP323\A0054814.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP323\A0054823.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP325\A0054982.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP326\A0055005.dll tagged as "not-a-virus:AdWare.ToolBar.Neon.a". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP326\A0055007.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP328\A0055023.DLL tagged as "not-a-virus:AdWare.Toolbar.MyWay.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055029.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055046.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055082.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055099.DLL tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP329\A0055114.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP332\A0055140.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP332\A0055144.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP332\A0055156.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP333\A0055160.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP334\A0055171.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP336\A0055201.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP336\A0055202.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055231.DLL tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055234.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055245.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055246.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055258.DLL tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP337\A0055259.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055300.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055301.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055307.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055315.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055316.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP339\A0055317.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP340\A0055324.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP340\A0055333.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP340\A0055334.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP340\A0055335.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP341\A0055348.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP341\A0055357.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP341\A0055358.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP341\A0055359.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055366.dll infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055367.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055371.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055372.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055384.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055432.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055433.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055434.exe infected by "Trojan-Downloader.Win32.Agent.is" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055435.exe infected by "Trojan.Win32.Agent.cl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055520.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055523.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0055526.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057364.dll tagged as "not-a-virus:AdWare.Coreak". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057379.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057382.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057383.exe tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057434.dll tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP342\A0057653.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP359\A0058075.dll infected by "Backdoor.Win32.Agent.iw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP359\A0058096.dll infected by "Backdoor.Win32.Agent.iw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP359\A0058110.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP360\A0058126.DLL tagged as "not-a-virus:AdWare.Toolbar.MyWay.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP361\A0058152.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP361\A0059173.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP362\A0059309.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP362\A0059346.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP362\A0059354.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059609.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060480.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060484.dll infected by "Backdoor.Win32.Agent.iw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060491.dll infected by "Trojan.Win32.Agent.co" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060759.exe infected by "Trojan-Downloader.Win32.Agent.km" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060760.exe tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060761.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060774.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP369\A0060873.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062458.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062719.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062768.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP370\A0062790.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP371\A0062879.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP371\A0062908.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP372\A0062955.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP372\A0062961.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP373\A0062977.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP373\A0063017.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP374\A0063067.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP374\A0063130.dll tagged as "not-a-virus:AdWare.NavExcel.g". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP375\A0063174.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP375\A0063197.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP375\A0063224.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063253.dll tagged as "not-a-virus:AdWare.NavExcel.f". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063254.exe tagged as "not-a-virus:AdWare.NavExcel". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063255.exe tagged as "not-a-virus:AdWare.NavExcel.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063256.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063257.exe tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063258.dll tagged as "not-a-virus:AdWare.NavExcel.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063270.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063290.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP376\A0063314.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP377\A0063340.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP377\A0063341.exe infected by "Trojan-Downloader.Win32.Agent.is" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP377\A0063362.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP378\A0063381.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP379\A0063428.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP379\A0063465.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP380\A0063499.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP380\A0063525.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP380\A0063551.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP381\A0063579.dll infected by "Trojan-Proxy.Win32.Small.bw" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP381\A0063608.exe infected by "Trojan-Dropper.Win32.Small.wv" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP382\A0063614.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP382\A0063616.dll tagged as not-a-virus:RiskWare.Proxy.MarketScode.c. No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065010.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065013.dll tagged as "not-a-virus:AdWare.ToolBar.Neon.a". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065014.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065015.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065016.exe infected by "Trojan-Downloader.Win32.Agent.is" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065017.exe infected by "Backdoor.Win32.Webdor.p" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065018.exe infected by "Trojan-Downloader.Win32.Small.hx" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065019.exe infected by "Trojan-Downloader.Win32.Agent.km" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065020.exe tagged as "not-a-virus:AdWare.NavExcel.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP395\A0065021.exe infected by "Trojan-Dropper.Win32.Small.zg" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\drivers\etc\hosts.bak infected by "Trojan.Win32.Qhost.av" Virus! Action Taken: No Action Taken.
File E:\Christine\docs\mirc616.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059662.exe infected by "Backdoor.Win32.SdBot.gen" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059663.exe infected by "Backdoor.Win32.SdBot.gen" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059664.EXE infected by "Backdoor.Win32.SdBot.cj" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059665.exe infected by "Worm.Win32.Lovesan.a" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059666.exe infected by "Backdoor.Win32.SdBot.ck" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059667.exe infected by "Worm.Win32.Randex.d" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP366\A0059668.exe infected by "Backdoor.Win32.Tsunami.c" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP368\A0060758.EXE tagged as not-a-virus:RiskWare.Tool.PsExec.123. No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP371\A0062831.exe infected by "Trojan.BAT.NoShare.n" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP371\A0062846.exe infected by "Trojan.BAT.NoShare.n" Virus! Action Taken: No Action Taken.
File E:\System Volume Information\_restore{DB679D22-83A8-4490-9A37-35D54733565F}\RP371\A0062848.EXE tagged as not-a-virus:RiskWare.Tool.PsExec.131. No Action Taken.
File E:\WINNT\system32\lodesa\mirc7.exe infected by "Trojan.BAT.NoShare.n" Virus! Action Taken: No Action Taken.
File E:\WINNT\system32\lodesa\xe.EXE tagged as not-a-virus:RiskWare.Tool.PsExec.131. No Action Taken.


Many thanks - so far so good.
Post #10
Please delete the following File/Folder:

C:\!Submit << Whole Folder
C:\WINDOWS\system32\drivers\etc\hosts.bak << File Only


Delete your Temporary Internet Files (Start > Control Panel > Internet Options > Delete Files), be sure to also select delete all offline content.
Empty the Recycle Bin.


Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK twice, and then click Yes when you are prompted to restart the computer.
4. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore'


Reboot the computer and scan with mwavscan to be sure all bad files are now gone. Post the new mwavscan log as a reply to this thread.
Post #11
Here's the latest MWAV scan : Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\REGOBJ.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{00000000-6CB0-410C-8C3D-8FA8D2011D0A}" refers to invalid object "C:\Program Files\iMesh\iMesh5\iMeshBHO.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{025F0828-520C-4237-BE67-1CDCB18395D5}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{02E389CB-7FD5-407B-9622-3E229C2E3993}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0944D16C-D0F4-4389-982A-A085595A9EB3}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0FD95BFE-8321-11D2-B10D-00805F88185D}" refers to invalid object "C:\PROGRA~1\ACAD2000\express\axrtext.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{11DD4A33-BB11-46B8-8BAF-8FDD322C444F}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{163955B9-B4D8-41C0-9506-DF87C8874833}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{19658F50-BC67-4A43-ADB9-6BF368CD8488}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1D6A33F4-DA26-4ED9-A72D-B6C2A3C7C1BE}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{241C21E3-D814-49E8-9FCD-961E0ECAF3E2}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{2aa2b5fe-b846-4d07-810c-b21ee45320e3}" refers to invalid object "%SystemRoot%\System32\xmlprovi.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{2AD750D2-FBAA-44DE-B2C8-EA70AA1BC770}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{2CDB6749-F14C-446F-9852-747AAD75B805}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3831331E-0D11-4716-871D-68F3B11D23C9}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3DCD2BC5-8489-48AE-891F-90C8B2F19F56}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3E92C53C-C8A9-40D2-82B2-CEA59E45C6CB}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3FD730D1-9DD5-4AE8-9857-F12F06CFFD2A}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{40B4DD9D-83C1-11D2-B340-0060B0B3B2E6}" refers to invalid object "C:\PROGRA~1\ACAD2000\express\axctextapp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{41600CBD-0A19-11D2-B54A-080009D023F9}" refers to invalid object "C:\PROGRA~1\ACAD2000\shapes.arx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{42AB8D08-F741-4166-8A0D-3C1A50B43F93}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\GnucCOM.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{42F7324B-B32A-4734-8F8A-C820443EC948}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{464BA7B8-520A-484A-B4F6-609C4A76AD2B}" refers to invalid object "C:\WINDOWS\System32\pppnaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{46814717-161A-46F1-9D4E-D7B34017877C}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{498E125B-004C-4F46-9AED-EC3D9D807683}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5224C8FC-ECAC-4C19-AA12-AE322BFEEC13}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{52C01A76-19E2-4A50-AE8A-38FFBCCF9182}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{53E05B28-A7CD-4DC7-A1B7-4786862F976E}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{55EA37B6-5D8A-4BA0-B3FF-9B3B57F1ACB0}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{56336BCA-3D8A-11d6-A00B-0050DA18DE71}" refers to invalid object "C:\DOCUME~1\steven\LOCALS~1\Temp\InfoWindow.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{566B6631-0096-4CA2-B2BD-FC27CA65684E}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5954EA75-9BFA-461A-BD34-CEA3A861FF19}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}" refers to invalid object "C:\WINDOWS\System32\twext.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{59813F2D-5AA1-4C57-9B84-A928639AF157}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5A45F9E3-54A0-4B10-B642-725928B8FD51}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5AAF5475-1102-4DF2-889C-D803047B14AA}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5B65AF81-D3A0-4B96-AE28-53FB538F4BBC}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5CE53745-5040-4B0F-96C4-37973AF0ECDE}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5DAB01A0-C479-4DAE-97CF-6D928AC2DF01}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5EAA54AB-6601-40E4-A13F-01559500D2C7}" refers to invalid object "C:\Program Files\iMesh\iMesh5\searchMesh.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5F3FDC91-FA3C-4ECD-BFF0-2E4527769D75}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{60D0ABB3-404F-4445-9567-3F47558662F5}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{684345E8-49F5-4C83-92B7-648CFECA443C}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{72C95A4D-E126-4D50-97A2-3C21BB5AFC8B}" refers to invalid object "C:\WINDOWS\System32\pppnaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{740C3B30-4E79-4581-9F2F-8918599BD673}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{75BA43D6-1C7C-4D76-B75D-6753D58841D3}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{762EC429-1A5D-4AB8-844A-9A552E1241DA}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{78A6BF3D-3059-4481-BA57-443C007E1785}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{8016B1B6-E6A1-4454-9EEE-07AE17D308E3}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{8076BC70-751C-4BE5-A120-01BE19FB63FE}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{87B157B0-7EB8-4869-88B5-D6C67D5C46E0}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{948BD7F7-1DBE-4080-B013-7661927E154A}" refers to invalid object "C:\WINDOWS\System32\lhillec.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{953F0A35-055D-4223-AE19-BF77861EBC4D}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{963551BE-53D6-4D5B-A7D7-30A9EFF1E539}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{96919A10-6AD0-4C08-AE6B-289C1D3913A3}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{988FFDFB-7801-430D-A3D3-245FFD21CA6D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{9A8BC2FF-D9FE-4A2F-8DB3-3389FA4A4730}" refers to invalid object "C:\WINDOWS\lbbho.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{9DB7A13C-F208-4981-8353-73CC61AE2783}" refers to invalid object "C:\WINDOWS\System32\twext.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A4E6C18C-9A96-4A63-AAE3-2E5B250CEAD0}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A506EF88-9EFC-4522-BFE1-A8E886A64D80}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A5704C37-40DA-49EF-904B-97E5F5F9B1C5}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A5E97FBA-B32C-49C4-8298-22C50399F918}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A8D79E06-0CF9-4FCD-A516-F3A196B7EE3C}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{AC757038-67D5-4279-9F42-970241693AA0}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{AE369A29-85C5-4209-A0A0-C11C8807005E}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B0244E17-9371-42EF-A942-AD94565C2D30}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B1143F99-C612-4647-9D7A-7FC269278EB2}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B3647401-DCAD-4B7F-900E-4E37B4BF5283}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B3F948C3-53A2-48F4-8A81-E9DFE79E1B27}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B87799AF-2CE9-4DAA-93CF-65F002035369}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{BBC73C94-337C-43CC-B52C-31EB9FA34013}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C017460E-5BAA-4EAC-8B7D-D76E93F1352D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C406F816-318D-4F7D-81CB-BA93CA7B70D5}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C4ED76AB-5BE2-4B92-A502-C7272B18E2E9}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C708C589-6563-4ACB-AF3B-522648E4DD7D}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C8B80674-5F31-41F2-AD78-DA531A00AE8A}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C9668AE4-4DAA-4618-B0B1-5CD333D111F6}" refers to invalid object "C:\WINDOWS\System32\mgjojba.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{D3E23E38-9A4D-4BCB-B05A-7028330157AB}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{D502D4A3-03E6-4EAE-A14E-69606CA63430}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{DD2A07A0-F5A8-45B8-BA4F-51887CF4589A}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{E4945DEA-7750-4778-A9C9-F8A903D22704}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{E6E54979-1750-487B-93A9-8F0CAF31C5A8}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{E9A6464C-8653-4366-BD80-C4B5B4956AC4}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{EB98940B-9D3E-48D6-AEB7-72910DB95721}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{EC22770D-3343-4C56-8A8D-3E560475F655}" refers to invalid object "C:\PROGRA~1\iMesh\iMesh5\actskin4.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{ED82B2C2-6786-4A92-B2B3-D694B508364D}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F0FAEDFA-DCF6-4627-B172-17EC72A87603}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F65C9AE8-1E60-492C-9C48-CD895C644184}" refers to invalid object "C:\WINDOWS\System32\mhgmaaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F86D575F-5D50-4543-AF5E-7A8736768CDB}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F97A6C5F-E59D-4467-A026-AA7A0D6B1F11}" refers to invalid object "C:\WINDOWS\System32\khbpmaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{FD19E70C-9F2D-4CE5-9E76-13BD45FBAFD8}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{FE014943-7E6A-4ADD-9FB4-1FA6CF0A06D9}" refers to invalid object "C:\WINDOWS\System32\nfgdbaa.dll". Action Taken: No Action Taken. Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\RegObj.Registry" refers to invalid object "{C55A1680-CD5A-11CF-8D29-444553540000}". Action Taken: No Action Taken. Entry "HKCR\RegObj.Registry.1" refers to invalid object "{C55A1680-CD5A-11CF-8D29-444553540000}". Action Taken: No Action Taken. Entry "HKCR\Shutterfly.UploaderCtrl.2.0.3.0" refers to invalid object "{9600F64D-755F-11D4-A47F-0001023E6D5A}". Action Taken: No Action Taken. Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. File C:\Documents and Settings\Grace\Local Settings\Temporary Internet Files\Content.IE5\UELQ2V2S\dl[1].exe infected by "Trojan-Downloader.Win32.Agent.il" Virus! Action Taken: No Action Taken. File C:\Program Files\ACAD2000\migration\pictaker\PTEEEval.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\WINNT\system32\lodesa\mirc7.exe infected by "Trojan.BAT.NoShare.n" Virus! Action Taken: No Action Taken. File E:\WINNT\system32\lodesa\xe.EXE tagged as not-a-virus:RiskWare.Tool.PsExec.131. No Action Taken. Computer is still behaving well. Many thanks
Post #12
Just one item remaining. :)

Reboot the computer into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').

Double-click on Killbox.exe to run it.
In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\Documents and Settings\Grace\Local Settings\Temporary Internet Files\Content.IE5\UELQ2V2S\dl[1].exe


Check the option for "Delete on Reboot". Click the button with the red circle with a white X in it. Click 'yes'. When asked to reboot choose 'yes'.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

Here are three very good and free malware scanners:

Spybot Search and Destroy 1.3
AdAware SE v1.06
Set-up Instructions for Spybot S&D; and Adaware SE
a² Free Trojan Remover

If you have them already, check to make sure that they are the newest version.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Post #13
hello ALSOCOM :) Many thanks - system runs fantastic with no creepy crawlies and other unpleasant surprises detected by TM , spybot and ADAWARE. Most important of all , I feel safer now to let the kids onto the net with all the necessary safeguards in place. You are awesome ! Once again many thanks :wavey: regards
Post #14
Your welcome. Glad to hear the computer is working well for you now.


As this topic has been resolved, the thread will be closed.

If you need this topic reopened, please request this by sending an email to us at the following link: (Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI