please help, I'm going insane!

Hello,

It has been five days now. I know how busy you must all be. Thank you for taking the time to do what you all do. I'll take my reply whenever you have time. Here is my link.

http://forums.tomcoyote.org/index.php?showtopic=38053


Thanks again,

DTF

Please download and run CWShredder. Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

http://www.majorgeeks.com/downloadget.php?…7fd6b3ff02edc90

REBOOT

Step #2

Please download and run Spybot & AdAware SE Then follow the instructions in the link below to run.

Spybot & Adaware Tutorial

REBOOT

Step # 3

Then do 2 virus scans here >>>

Trend Micro

Panda

Reboot and post a new HiJackThis log.

Scan with hijackthis and put a check beside these lines and choose FIX

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [eqddic] c:\windows\system32\eqddic.exe
O4 - HKLM\..\Run: [3IqiQUA] C:\WINDOWS\tqqqbufs.exe
O4 - HKLM\..\Run: [nzclbyc] c:\windows\system32\inzknl.exe
O4 - HKLM\..\Run: [sFrT38U] lfpstr.exe
O4 - HKCU\..\Run: [do03RUYnR] javawex.exe

O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)


Then reboot and post a new log please. You can try online virus scans here

Trend Micro http://housecall.antivirus.com/

E Trust http://www3.ca.com/virusinfo/virusscan.aspx

Rav http://www.ravantivirus.com/scan/

Pc Pitstop http://www.pcpitstop.com/antivirus/AV.asp

Panda http://www.pandasoftware.com/activescan/co…n_principal.htm

Bitdefender http://www.bitdefender.com/scan/Msie/index.php

Looks good how is it running?

Hello, I forgot to mention the names of the spyware. I'm just going from my memory here, so forgive any mistakes. Apropos Ist people on page I hope this helps some. let me know if you need any more information. A million thanks, DTF

Download MicroWorld virus scan here >>> Micro World http://www.mwti.net/antivirus/free_utilities.asp

To run the virus scan make sure you click the following

memory, registry, startup folders, system folders, services, drive (all drives will be added) then click on scan clean. When the scan is complete hilight all the files in the LOWER box. Then ctrl + c and paste them into the thread ctrl + v.

I warn you the scan will take a long time to run and will not fix anything just identifies bad files.

Here is MW log. WOW! What a mess! In your debt, DTF Object "IBIS Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "SideFind Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "mxoaldr Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\msxml3a.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\plugincpl131.cpl". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\MSPress\Training\lsingle.CNT". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Broderbund\UMM\Air&car.ab2". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Broderbund\UMM\Gvtoffcl.ab2". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Broderbund\UMM\Health.ab2". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Broderbund\UMM\Hotels.ab2". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Broderbund\UMM\Majcorps.ab2". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Broderbund\UMM\Print60.dat". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C370527A-24A7-4583-BE01-72E59000EB17}" refers to invalid object "C:\WINDOWS\system32\n.dll". Action Taken: No Action Taken. Entry "HKCR\PopUp.xpTuner Pro" refers to invalid object "{49E0E0F0-5C30-11D4-945D-000000000003}". Action Taken: No Action Taken. Entry "HKCR\ToolBand.ToolBandHelper" refers to invalid object "{441354C5-911B-409B-9A66-A11D6D4E1A22}". Action Taken: No Action Taken. Entry "HKCR\ToolBand.ToolBandHelper.1" refers to invalid object "{441354C5-911B-409B-9A66-A11D6D4E1A22}". Action Taken: No Action Taken. File C:\WINDOWS\cpbrkpie.ocx tagged as "not-a-virus:AdWare.Coupons". Action Taken: No Action Taken. File C:\WINDOWS\ddnkzsf.exe tagged as "not-a-virus:AdWare.BetterInternet.c". Action Taken: No Action Taken. File C:\WINDOWS\Nail.exe tagged as "not-a-virus:AdWare.BetterInternet.b". Action Taken: No Action Taken. File C:\WINDOWS\System32\javawex.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\WINDOWS\System32\lfpstr.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\WINDOWS\System32\nsy1C.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.g". Action Taken: No Action Taken. File C:\WINDOWS\System32\ps1.exe tagged as "not-a-virus:AdWare.Pacer.h". Action Taken: No Action Taken. File C:\DOCUME~1\Tanya\LOCALS~1\Temp\1.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\DOCUME~1\Tanya\LOCALS~1\Temp\Del34.tmp tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken. File C:\DOCUME~1\Tanya\LOCALS~1\Temp\drp4D.tmp\thnall2c.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\DOCUME~1\Tanya\LOCALS~1\Temp\drp98.tmp\thnall2c.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\DOCUME~1\Tanya\LOCALS~1\Temp\drp9E.tmp\thnall2c.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\DOCUME~1\Tanya\LOCALS~1\TEMPOR~1\Content.IE5\M3YF46HE\a072aa[1].js infected by "Trojan-Downloader.JS.Small.aq" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Tanya\LOCALS~1\TEMPOR~1\Content.IE5\YL7SXO3M\a072aa[1].js infected by "Trojan-Downloader.JS.Small.aq" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Tanya\Local Settings\Temp\1.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\Documents and Settings\Tanya\Local Settings\Temp\Del34.tmp tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken. File C:\Documents and Settings\Tanya\Local Settings\Temp\drp4D.tmp\thnall2c.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\Documents and Settings\Tanya\Local Settings\Temp\drp98.tmp\thnall2c.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\Documents and Settings\Tanya\Local Settings\Temp\drp9E.tmp\thnall2c.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\Documents and Settings\Tanya\Local Settings\Temporary Internet Files\Content.IE5\M3YF46HE\a072aa[1].js infected by "Trojan-Downloader.JS.Small.aq" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Tanya\Local Settings\Temporary Internet Files\Content.IE5\YL7SXO3M\a072aa[1].js infected by "Trojan-Downloader.JS.Small.aq" Virus! Action Taken: No Action Taken. File C:\Program Files\Broderbund\The Print Shop\Unlock\SSD\SS4DlxDl.EXE tagged as not-a-virus:Tool.WinCap.Reboot. No Action Taken. File C:\Program Files\Windows Media Player\wmplayer.exe.tmp tagged as "not-a-virus:AdWare.Pacer.e". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP144\A0024628.exe infected by "Trojan.Win32.Dialer.dw" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP147\A0025844.exe tagged as not-a-virus:Tool.WinCap.Reboot. No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP147\A0025885.exe tagged as "not-a-virus:AdWare.Pacer.e". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025926.exe tagged as "not-a-virus:AdWare.Wintol.ab". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025927.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025928.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025929.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025930.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025931.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025932.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025933.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025934.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025935.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025936.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025939.exe infected by "Trojan.Win32.Stervis.c" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025941.exe infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025946.dll tagged as "not-a-virus:AdWare.WebSearch.aj". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025958.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025959.exe tagged as "not-a-virus:AdWare.BetterInternet.b". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025977.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025981.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0025983.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026045.exe infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026069.exe infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026070.dll infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026071.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026073.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026175.exe infected by "Trojan.Win32.Stervis.c" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026176.exe tagged as "not-a-virus:AdWare.BetterInternet.c". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026177.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026178.exe tagged as "not-a-virus:AdWare.BetterInternet.b". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026218.exe infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026224.exe infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026226.dll infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026228.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026229.exe infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026243.exe infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026244.dll infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026246.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026247.exe infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026254.exe infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026255.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026256.dll infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026259.exe infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026290.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026291.exe infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026292.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026293.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.g". Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026295.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026302.dll infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026309.exe infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026312.dll infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026313.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026334.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP148\A0026335.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP149\A0026533.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP149\A0026534.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026577.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026578.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026579.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026580.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026586.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026587.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026588.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026589.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026590.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026591.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026592.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP152\A0026593.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026643.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026644.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026645.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026646.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026647.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026648.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026649.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026650.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026682.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026683.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026684.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026685.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026689.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026690.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026691.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026692.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026693.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026694.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026695.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP154\A0026696.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026736.exe infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026738.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026739.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026817.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026818.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026819.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026820.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026821.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026822.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026823.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{1DF014E9-2A7C-4277-BD8A-14E12CE58FD5}\RP156\A0026824.dll infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\WINDOWS\cpbrkpie.ocx tagged as "not-a-virus:AdWare.Coupons". Action Taken: No Action Taken. File C:\WINDOWS\ddnkzsf.exe tagged as "not-a-virus:AdWare.BetterInternet.c". Action Taken: No Action Taken. File C:\WINDOWS\Nail.exe tagged as "not-a-virus:AdWare.BetterInternet.b". Action Taken: No Action Taken. File C:\WINDOWS\system32\javawex.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\WINDOWS\system32\lfpstr.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken. File C:\WINDOWS\system32\nsy1C.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.g". Action Taken: No Action Taken. File C:\WINDOWS\system32\ps1.exe tagged as "not-a-virus:AdWare.Pacer.h". Action Taken: No Action Taken.

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please go to the following website
http://www.noidea.us/easyfile/file.php?dow…050515010747824
. Click on Spyware Utilities.
. Then click on Nail/Aurora Fix
download Nailfix.exe
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml



Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Scan with hijackthsi and put a heck beside these lines and choose FIX

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html

O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun

O16 - DPF: {2564B8E6-7D84-11D4-A689-30475BC10000} (Tkweb Control) - http://www.toolkitcma.com/tkweb/tkweb.cab

O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4047/ftp…23/cpbrkpie.cab
Then reboot and post a new log please.