Hijackthis log

Here is the log from the first scan. Please help. im swamped with pop ups im about to go crazy!! they come on as soon as i start up!!

Logfile of HijackThis v1.99.1
Scan saved at 7:45:48 PM, on 7/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\System32\rmrnap.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\vidctrl\vidctrl.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\minrtz.exe
C:\WINDOWS\System32\cabcfg.exe
C:\WINDOWS\System32\memtvid.exe
C:\WINDOWS\System32\cabcfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Aprps\CxtPls.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\Aprps\cxtpls.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\System32\richedtr.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\System32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\eliteicr32.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\rmrnap.exe reg_run
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\System32\richup.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [pF4f38j] minrtz.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [YovpRUHtX] memtvid.exe
O4 - HKCU\..\Run: [cabcfg] C:\WINDOWS\System32\cabcfg.exe
O4 - HKCU\..\RunOnce: [cabcfg] C:\WINDOWS\System32\cabcfg.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.google.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118299597032
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\brackbox.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

I wanted to say thank you for taking time to help me out with my computer. I downloaded the things you asked me to, i ran etremover and did a full scan with ewido, here are my logs..
Logfile of HijackThis v1.99.1
Scan saved at 12:17:36 AM, on 7/21/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\System32\w?nword.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Cas\Client\casclient.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\iowl\ouua.exe
C:\WINDOWS\System32\wuauclt.exe
D:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {F57FF82D-11C7-7E17-910C-32A680AD39E3} - C:\WINDOWS\System32\yywcph.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\jojanb.exe reg_run
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Ybalfxas] C:\WINDOWS\System32\w?nword.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [Pwrl] C:\Program Files\iowl\ouua.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.google.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118299597032
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\Cas\Client\casmf.dll
O20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\cbl3dv2.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 11:34:32 PM, 7/20/2005
+ Report-Checksum: 4798273E

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{417386C3-8D4A-4611-9B91-E57E89D603AC} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6DF5E318-6994-4A41-85BD-45CCADA616F8} -> Spyware.eZula : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B5AB638F-D76C-415B-A8F2-F3CEAC502212} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{10D7DB96-56DC-4617-8EAB-EC506ABE6C7E} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{370F6327-41C4-4FA6-A2DF-1BA57EE0FBB9} -> Spyware.eZula : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{6CDC3337-01F7-4A79-A4AF-0B19303CC0BE} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{795398D0-DC2F-4118-A69C-592273BA9C2B} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B288F21C-A144-4CA2-9B70-8AFA1FAE4B06} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{EFA52460-8822-4191-BA38-FACDD2007910} -> Spyware.eZula : Cleaned with backup
HKLM\SOFTWARE\Classes\PopOops2.PopOops -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\PopOops2.PopOops\Clsid -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\SWLAD1.SWLAD -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\SWLAD1.SWLAD\Clsid -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{BAF13496-8F72-47A1-9CEE-09238EFC75F0} -> Spyware.eZula : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{D0C29A75-7146-4737-98EE-BC4D7CF44AF9} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{E0D3B292-A0B0-4640-975C-2F882E039F52} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DisplayUtility -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-606747145-789336058-854245398-1003\Software\Mvu -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-606747145-789336058-854245398-1003\Software\{12EE7A5E-0674-42f9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
C:\WINDOWS\system32\jzt.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mzexcl40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\nsvsvc\nsvsvc.exe -> Spyware.Delfin : Cleaned with backup
C:\WINDOWS\system32\nsvsvc\nsvs.dll -> Spyware.Delfin : Cleaned with backup
C:\WINDOWS\system32\vidctrl\vidctrl.exe -> Spyware.DelphinMediaViewer : Cleaned with backup
C:\WINDOWS\system32\jojanb.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\system32\eient97.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\aktxprxy.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\AUNPS2.dll -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\stecli.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\datadx.dll -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\WINDOWS\system32\ibm32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\itgutil.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\urandlg.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\conres.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\WINDOWS\system32\bobramm.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\system32\jbjoa.dll -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\system32\mmxmlr.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mtvcp71.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\inrop.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\e6f1873b.dll -> TrojanDownloader.Braidupdate.d : Cleaned with backup
C:\WINDOWS\system32\brackbox.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\ru.exe -> Spyware.PurityScan : Cleaned with backup
C:\WINDOWS\NDNuninstall6_38.exe -> Spyware.NewDotNet : Cleaned with backup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ntnp.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\Documents and Settings\Jack Sparrow\Local Settings\Temp\temp.frA017\seng.dll -> Adware.eZula : Cleaned with backup
C:\Documents and Settings\Jack Sparrow\Local Settings\Temp\uninstall.exe -> Spyware.EliteBar : Cleaned with backup
C:\Documents and Settings\Jack Sparrow\Local Settings\Temp\nstA1.EXE -> Spyware.SmartPops : Cleaned with backup
C:\Program Files\iowl\ouua.exe -> Spyware.PurityScan : Cleaned with backup
C:\Program Files\CasStub\casstub.exe -> TrojanDownloader.Agent.qg : Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP27\A0008494.exe -> Spyware.iSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP27\A0008495.exe -> Spyware.iSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010204.DLL -> Adware.eZula : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010210.exe -> Adware.eZula : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010211.exe -> Adware.EZula : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010213.dll -> Adware.eZula : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010217.exe -> Adware.eZula : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010218.exe -> TrojanDownloader.Agent.er : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010223.EXE -> Adware.eZula : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010224.dll -> Adware.eZula : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP31\A0010231.DLL -> Adware.eZula : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0013645.dll -> Spyware.Suggestor : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0013657.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0013660.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0013668.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0013670.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014658.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014664.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014667.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014668.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014679.dll -> Spyware.SmartPops : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014680.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014681.exe -> Spyware.Suggestor : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014683.exe -> Spyware.WinAD : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014684.exe -> Spyware.WinAD : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014685.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014688.scr -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014691.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014692.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014693.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014694.SCR -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014696.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014697.EXE -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014699.DLL -> Spyware.Wesbar : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014700.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014701.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014702.EXE -> Spyware.Wesbar : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014704.dll -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014705.exe -> Spyware.NewDotNet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014706.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014708.exe -> TrojanDownloader.Intexp.c : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014710.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014711.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014712.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014748.exe -> TrojanDownloader.Small.ayh : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014853.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014856.exe -> TrojanDownloader.Adload.a : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014859.exe -> Spyware.SmartPops : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014861.dll -> Spyware.NewDotNet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014862.EXE -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014871.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015063.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014889.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014899.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014901.exe -> TrojanDownloader.Adload.a : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014908.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014912.EXE -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014921.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014927.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014937.exe -> TrojanDownloader.Adload.a : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014938.EXE -> TrojanDownloader.Agent.ed : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014939.EXE -> TrojanDownloader.Apropo.ac : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014950.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014972.EXE -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015073.EXE -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014979.EXE -> Spyware.CashBack : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014980.EXE -> Spyware.CashBack : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015078.exe -> TrojanDownloader.Adload.a : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015080.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0014999.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015000.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015002.DLL -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015003.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015004.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015005.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015006.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015007.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015008.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015018.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015025.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015036.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015047.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015050.EXE -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0015088.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016081.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016086.EXE -> TrojanDownloader.Qoologic.v : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016095.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016114.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016127.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016138.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016147.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016149.EXE -> Spyware.CashBack : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016150.exe -> Spyware.CashBack : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016154.EXE -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016161.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016169.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016178.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016189.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016195.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016219.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016230.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016248.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0016257.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017250.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017258.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017260.exe -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017261.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017263.ocx -> Spyware.Delfin : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017264.exe -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017265.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017266.exe -> Spyware.Delfin : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017267.dll -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017268.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017269.dll -> TrojanDownloader.Qoologic.t : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP44\A0017270.exe -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0018258.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019250.exe -> TrojanDownloader.Agent.ed : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019251.exe -> TrojanDownloader.Apropo.ac : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019261.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019269.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019294.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019297.exe -> Spyware.SafeSurfing : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019314.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019315.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019330.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019331.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019332.exe -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019344.EXE -> TrojanDownloader.Small.abd : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019353.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019361.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019371.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019384.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019387.dll -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019412.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019417.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019428.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019430.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019431.exe -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019433.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019434.exe -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019435.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019436.dll -> TrojanDownloader.Qoologic.t : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019437.exe -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019448.dll -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019449.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP45\A0019450.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019473.dll -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019474.exe -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019491.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019492.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019497.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019498.exe -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019769.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019779.EXE -> TrojanDownloader.Agent.ed : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP46\A0019780.EXE -> TrojanDownloader.Apropo.ac : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020787.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020788.EXE -> TrojanDownloader.Small.aal : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020795.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020804.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020812.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020821.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020823.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020831.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020840.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020847.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020856.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020866.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020876.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0020877.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021885.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021890.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021891.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021996.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021899.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021900.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021901.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021997.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021905.exe -> TrojanDownloader.Adload.a : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021912.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021914.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021915.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021925.exe -> Spyware.CashBack : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021926.exe -> Spyware.CashBack : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021928.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022000.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022001.exe -> TrojanDownloader.Adload.a : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022002.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022003.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021935.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021950.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021951.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021952.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021954.exe -> TrojanDownloader.Agent.ed : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021955.exe -> TrojanDownloader.Apropo.ac : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021958.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021959.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021960.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021972.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021973.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0021974.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022017.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022022.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022029.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022030.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022228.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022038.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022039.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022229.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022046.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022051.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022230.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022059.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022060.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022231.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022070.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022071.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022232.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022078.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022079.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022083.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022084.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022233.dll -> TrojanDownloader.Braidupdate.d : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022091.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022092.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022093.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022094.EXE -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022095.exe -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022096.EXE -> TrojanDownloader.Qoologic.u : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022097.dll -> TrojanDownloader.Qoologic.t : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022099.DLL -> TrojanDownloader.Qoologic.s : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022100.EXE -> TrojanDownloader.Agent.qg : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022106.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022107.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022108.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022116.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022118.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022119.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022126.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022127.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022128.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022138.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022139.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022140.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022148.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022153.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022154.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022162.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022163.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022171.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022172.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022175.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022176.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022184.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022185.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022186.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022194.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022208.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{0520347D-0DB8-4082-BA80-9B8B47BCEEF4}\RP47\A0022209.exe -> Spyware.Hijacker.Generic : Cleaned with backup


::Report End
what steps should i take next?
and thank you again for helping me!

here is my next scan after running killbox and doing the other tasks.

Logfile of HijackThis v1.99.1
Scan saved at 8:21:32 AM, on 7/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.google.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118299597032
O20 - Winlogon Notify: IPConfTSP - C:\WINDOWS\system32\ilfosoft.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

here is the log after the option #2 scan…
L2Mfix 1.03a

Running From:
C:\Documents and Settings\Jack Sparrow\Desktop\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY –C——- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Jack Sparrow\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Jack Sparrow\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 1164 'explorer.exe'
Killing PID 1164 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 1584 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\nimarta.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nimarta.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mbc70.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mbc70.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ilfosoft.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ilfosoft.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\nimarta.dll
Successfully Deleted: C:\WINDOWS\system32\nimarta.dll
deleting: C:\WINDOWS\system32\nimarta.dll
Successfully Deleted: C:\WINDOWS\system32\nimarta.dll
deleting: C:\WINDOWS\system32\mbc70.dll
Successfully Deleted: C:\WINDOWS\system32\mbc70.dll
deleting: C:\WINDOWS\system32\mbc70.dll
Successfully Deleted: C:\WINDOWS\system32\mbc70.dll
deleting: C:\WINDOWS\system32\ilfosoft.dll
Successfully Deleted: C:\WINDOWS\system32\ilfosoft.dll
deleting: C:\WINDOWS\system32\ilfosoft.dll
Successfully Deleted: C:\WINDOWS\system32\ilfosoft.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Desktop.ini sucessfully removed


Zipping up files for submission:
adding: nimarta.dll (deflated 48%)
adding: mbc70.dll (deflated 48%)
adding: ilfosoft.dll (deflated 48%)
adding: guard.tmp (deflated 48%)
adding: echo.reg (deflated 10%)
adding: clear.reg (deflated 22%)
adding: desktop.ini (stored 0%)
adding: readme.txt (deflated 49%)
adding: direct.txt (stored 0%)
adding: report.txt (deflated 64%)
adding: lo2.txt (deflated 79%)
adding: test2.txt (stored 0%)
adding: test3.txt (stored 0%)
adding: test5.txt (stored 0%)
adding: test.txt (deflated 78%)
adding: xfind.txt (deflated 74%)
adding: backregs/shell.reg (deflated 74%)
adding: backregs/2E52A2FD-1798-4C09-B76E-C7B34F3E9072.reg (deflated 70%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators … successful

deleting local copy: nimarta.dll
deleting local copy: nimarta.dll
deleting local copy: mbc70.dll
deleting local copy: mbc70.dll
deleting local copy: ilfosoft.dll
deleting local copy: ilfosoft.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\nimarta.dll
C:\WINDOWS\system32\nimarta.dll
C:\WINDOWS\system32\mbc70.dll
C:\WINDOWS\system32\mbc70.dll
C:\WINDOWS\system32\ilfosoft.dll
C:\WINDOWS\system32\ilfosoft.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{2E52A2FD-1798-4C09-B76E-C7B34F3E9072}"=-
[-HKEY_CLASSES_ROOT\CLSID\{2E52A2FD-1798-4C09-B76E-C7B34F3E9072}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
****************************************************************************



Here is the HJT log right after…..

Logfile of HijackThis v1.99.1
Scan saved at 9:07:23 PM, on 7/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.google.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118299597032
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

I will post another HJT log after Reboot.

I wanted to say thanks for helping me out… even though the computer is not totally done … it already seems sooo much better…

here is another HJT log after the reboot…

Logfile of HijackThis v1.99.1
Scan saved at 9:12:14 PM, on 7/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
D:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.google.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1118299597032
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

OK - Good News!

Here's………

Some preventive maintenance:

——————Must have or do:—————–

Now that you're clean: <—-Important Step!!!!
Delete your system restore files and create a new restore point:
(ME and XP users only)

XP system restore

ME system restore


Visit Windows Update and install all the lastest critical updates.

Install these two free programs, they sit in the backround and protect your system from spy and adware being installed on your system, also from your browser being hijacked. Check for updates weekly.

SpywareBlaster

SpywareGuard


IE-SPYAD
Puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
IE-SPYAD

SpyBot has some protection benefits - use them.

Need a free anti virus?
AVG*free
(check for updates - daily)

How about a firewall? The front door to your computer.
ZoneAlarm*free



———-Free malware removal programs:———-

SpyBot
AD-Aware
CW-Shredder

Free Online Trojan Scan

A SQUARED FREE TROJAN SCANNER

Trojan Hunter
TrojanHunter - free trial

Please consider using FireFox instead of Internet Explorer

Replace Java with SunJava

Pop-up stoppers:
GoogleToolBar
Pop-upStopperFree

Disable Windows MessengerXP - 2K (stops pop-up ads -etc):
Disabling Messenger Service in Windows XP
How to Remove Windows Messenger on Windows XP
How to Remove Windows Messenger on Windows XP
Shoot The Messenger


Don't open e-mail attachments without first scanning them with an up-to-date
anti virus program, even after doing that I would be very careful. Don't click on any executables in e-mails or any other links that you're not sure of.
Watch your surfing habits, don't click on or download anything you're not sure of. Don't install a program that hasn't been recommended by a reputable organization.

<=====><=====><=====><=====><=====><=====><=====><=====><=====><=====>

Disk Maintenance:

Make sure you clean up all the temp files frequently , I like this program: CCleaner
http://www.filehippo.com/download_ccleaner.html

Download, install and run it.
Use the default settings, just uncheck cookies.

————————————————————————
Clean up the registry:
I use RegCleaner, link below
http://www.capetechsupport.com/files/RegCleaner.exe
http://www.worldstart.com/weekly-download/…-cleaner4.3.htm
http://www.worldstart.com/weekly-download/…/regcleaner.exe

Download and install it.
Click on the RegCleanr.exe
Tools (at the top) > Registry Cleanup > Do Them All
Then 'Select' (at top left) > choose ALL
'Remove Selected" (at bottom right)
A backup of all that was removed will be made, just choose 'Backups' (top right) to view them, you can delete them when you're confident they're no longer needed.

—————————————————————-

Finally run defrag:
Start/Programs/Accessories/System Tools/Disk Defragmenter
Here's an excellent alternative tool - Diskeeper Lite
http://www1.execsoft.com/dklite.exe
http://www.webattack.com/get/dkeeperlite.shtml

Good luck and thanks for using the forum - MrC