searchweb2 help! Here's log

Hello golfer_34 and welcome to TomCoyote.

Step 1
Before beginning this fix please Move HijackThis to Permanent Folder:
HijackThis needs to be unzipped into a permanent folder in order to save backups just in case something goes wrong.

• Go to Start > My Computer > and double click on C:.
• Now right click an open area and click New > folder and change the folder name to HJT.
• Extract HijackThis from the zipped file into this new folder.

Step 2
We need to disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft AntiSpyware.
• Click on Options, Settings.
• In the left pane, click on Real-time Protection.
• Under Startup Options uncheck Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
• Under Real-time spyware threat protection uncheck Enable real-time spyware threat protection (recommended).
• After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
• Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.

After the computer is clean, it is very important that you enable Real-time Protection again.


Step 3
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.htgcazwmhxftqyjt.us/v0NV_4XNcXc…D1qUkCvCCn.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {E03E242D-9BA6-307B-BE8C-C8D13AAAC0FB} - C:\DOCUME~1\Owner\APPLIC~1\Aimlogo\Knob Drv.exe

O4 - HKLM\..\Run: [Bleh Save Knob Pop] C:\Documents and Settings\All Users\Application Data\Encplusblehsave\fragweb.exe
O4 - HKLM\..\Run: [IE Runtimes] winis.exe
O4 - HKLM\..\RunServices: [IE Runtimes] winis.exe
O4 - HKCU\..\Run: [Ltho] C:\Documents and Settings\Owner\Application Data\ootr.exe
O4 - HKCU\..\Run: [PlusBrowse] C:\DOCUME~1\Owner\APPLIC~1\GPLFIL~1\info 32 manager.exe
O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe

O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…etup1.0.0.8.cab

Optional items to check with HijackThis.
Remove these if you do not use PartyPoker on this computer.
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll

With all other programs and browsers closed, click fix checked.


Step 4
Please set your computer to show all files.

• Double-click My Computer.
• Click the Tools menu, and then click Folder Options.
• Click the View tab.
• Clear "Hide file extensions for known file types."
• Under the "Hidden files" folder, select "Show hidden files and folders."
• Clear "Hide protected operating system files."
• Click Apply, and then click OK.

You will need to reverse this process when all steps are done.


Step 5
Please delete the following files/folders:

C:\WINNT\system32\winis.exe << File Only
C:\Documents and Settings\Owner\Application Data\ootr.exe << File Only

C:\Program Files\Common Files\updater << Whole Folder
C:\Documents and Settings\Owner\Application Data\Aimlogo << Whole Folder
C:\Documents and Settings\All Users\Application Data\Encplusblehsave << Whole Folder
C:\Documents and Settings\Owner\Application Data\GPLFIL~1 << Whole Folder with name beginning with Gplfil.

If you have any problem deleting these items, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.


Step 6
Click here to download mwavscan.

• Double-click it to run it.
• Read then accept the agreement.
• Check Drive, and select all local drives, scan all files, then press 'scan'. (This may take a while and will not fix anything)
• Once it finds something, it will prompt you so click OK.
• When it is completed, anything found will be displayed in the lower pane.
• Highlight it with the mouse, copy it (CTRL+C), and paste (CTRL+V) it in your next reply.

Note : It will find many orphaned registry entries so please do not be alarmed by the amount of items that show.


Step 7
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.

Hey, thanks alot for your time and help. The only problems that I had were that I did not have these 2 files/folders: C:\Documents and Settings\Owner\Application Data\ootr.exe C:\Program Files\Common Files\updater Otherwise, everything went fine. I downloaded the mwavscan and followed the directions and the scan was completed. You were right when saying it might take awhile, as it took over two hours. Alot of my adware/spyware scans, virus scans, etc. take a long time also. Do you have any ideas or suggestions on how to improve this? Well here is the results of the mwavscan [it sure found a lot]: Object "007 Spy Software Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "altnet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "funweb Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "gator Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "maxspeed Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "quicken Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\btiein.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\MemoryMeter.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\nCaseInstaller.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\nCASELib.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\btiein.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MemoryMeter.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\FileGrp\Msvcrt10.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\nCASELib.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\nCaseInstaller.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\System32\pxwma.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{00120005-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\PROGRA~1\Logitech\Video\Ltocx12n.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{00120007-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\PROGRA~1\Logitech\Video\Ltocx12n.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0932B8A4-BBB4-4bc0-A8AB-91C626950C75}" refers to invalid object "C:\WINNT\System32\LVUI2.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{09AC4892-81B7-4d39-B235-8F0DB0DAF4F8}" refers to invalid object "C:\WINNT\System32\LVUI2.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0dabacb1-1a16-4082-a610-3d0b3a2a94fc}" refers to invalid object "C:\Program Files\Winamp\Plugins\cddbuiwinamp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0DED49D5-A8B7-4d5d-97A1-12B0C195874D}" refers to invalid object "BdaPlgin.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1159F2AF-F989-4d11-8B34-9550029269BB}" refers to invalid object "C:\WINNT\System32\LVUI2.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{16F6619C-28C1-11D2-8073-00104B1F6CEA}" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\MEDIAB~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{189504B8-50D1-4AA8-B4D6-95C8F58A6414}" refers to invalid object "C:\PROGRA~1\AIM\sb.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{36B4D77E-1B50-43cd-952A-87A4EF495336}" refers to invalid object "C:\Program Files\Logitech\QuickCam\LIU_PROD.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3933DE4F-3551-11D3-AB53-00A0C976D016}" refers to invalid object "C:\Program Files\Logitech\QuickCam\Update.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{399CB6C4-7312-11D2-B4D9-00105A0422DF}" refers to invalid object "C:\PROGRA~1\MUSICM~1\MUSICM~1\HHACTI~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4C8DD17E-7079-4c7e-96E5-A7AFDB12F132}" refers to invalid object "C:\WINNT\System32\LVUI2.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4FE8FFE1-FCCA-49c4-A363-525AB7C5B7CF}" refers to invalid object "C:\WINNT\System32\LVUI2.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{517539A3-905F-4755-9F94-D91B095A07CC}" refers to invalid object "C:\WINNT\System32\LVUI2.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{55CA5893-FA1F-11D1-8031-00104B1F6CEA}" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\MEDIAB~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5872C980-0AAF-4cdb-A62D-4F453DA2EFAD}" refers to invalid object "C:\WINNT\System32\LVUI2.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{69E9B473-22E6-471D-8683-84BD1E4BECE1}" refers to invalid object "C:\Program Files\Winamp\Plugins\cddbcontrolwinamp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{6B86A59F-77FE-4D5C-B0B2-043DA72F203E}" refers to invalid object "C:\Program Files\Common Files\Logitech\QCDRV\BIN\camhelpr.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{756A2CB8-EC02-4DC8-8588-296C611A5365}" refers to invalid object "C:\PROGRA~1\COMMON~1\aolshare\Coach\ACHtmfu.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{78D80080-F388-11D3-9161-00105A07EA40}" refers to invalid object "C:\WINDOWS\SYSTEM\LCODCCMP.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{78D80081-F388-11D3-9161-00105A07EA40}" refers to invalid object "C:\WINDOWS\SYSTEM\LCODCCMP.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{78D80082-F388-11D3-9161-00105A07EA40}" refers to invalid object "C:\WINDOWS\SYSTEM\LCODCCMP.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{78D80083-F388-11D3-9161-00105A07EA40}" refers to invalid object "C:\WINDOWS\SYSTEM\LCODCCMP.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{91DA6287-52F0-4CCF-9D67-72842C9BB367}" refers to invalid object "C:\Program Files\Shockwave.com\Collapse II\ui\SwDRM.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{959F94FD-DD1E-11D2-B559-00105A0422DF}" refers to invalid object "C:\PROGRA~1\MUSICM~1\MUSICM~1\HHACTI~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{9EFBF860-5685-11D3-AA3D-00C04F4C5275}" refers to invalid object "cdooff.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{9F687A48-9B3B-40A7-AAB8-DC02B7D9A83D}" refers to invalid object "C:\Program Files\Common Files\Logitech\QCDRV\BIN\camsvrps.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A98ABF1C-107C-44E7-9254-2C3FF435D0C2}" refers to invalid object "C:\PROGRA~1\AIM\sb.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{ACA896DC-E11A-4E31-B5E5-65A33F9D72DC}" refers to invalid object "C:\Program Files\Common Files\Logitech\QCDRV\BIN\troublag.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B9F3009B-976B-41C4-A992-229DCCF3367C}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\axtrack.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{BE265956-6F5F-4790-9CAB-EDFAC64362EF}" refers to invalid object "C:\Program Files\AIM\rtvideo.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{bfe639ee-762e-46c4-ae7c-3c34ccc317ff}" refers to invalid object "C:\Program Files\Winamp\Plugins\cddbcontrolwinamp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{c2e21ac1-675c-4cae-ba0c-98d25a5e5b84}" refers to invalid object "C:\Program Files\Winamp\Plugins\cddbcontrolwinamp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C6FB88EC-87A0-1B75-BA64-72BD8C6656B7}" refers to invalid object "C:\DOCUME~1\Owner\APPLIC~1\Aimlogo\Knob Drv.exe". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CD7DA9CA-09DF-4f47-A140-20FCAAC659D5}" refers to invalid object "C:\Program Files\Logitech\QuickCam\LIU_UPD.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{DE7371F4-4CCD-47cd-B12B-8887C9125895}" refers to invalid object "C:\WINNT\System32\LVUI2.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{E9AEE625-5EC8-11d3-AB53-00A0C976D016}" refers to invalid object "C:\Program Files\Logitech\QuickCam\LVMAVI.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{f1110c60-736a-4d58-8e2a-4935dfcf9ac7}" refers to invalid object "C:\Program Files\Winamp\Plugins\cddbcontrolwinamp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{f2e9891e-0ce2-40bc-a6df-ed87c817b83d}" refers to invalid object "C:\Program Files\Winamp\Plugins\cddbcontrolwinamp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{FD0A5AF3-B41D-11d2-9C95-00C04F7971E0}" refers to invalid object "BdaPlgin.ax". Action Taken: No Action Taken. Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken. Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken. Entry "HKCR\Automap.Map.NA" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken. Entry "HKCR\Automap.Map.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken. Entry "HKCR\Automap.Template.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken. Entry "HKCR\LEAD.LeadCtrl.120" refers to invalid object "{00120000-B1BA-11CE-ABC6-F5B2E79D9E3F}". Action Taken: No Action Taken. Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken. Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken. Entry "HKCR\SpyDoctor.EBankProblem" refers to invalid object "{AE612304-E8F9-45D9-A444-32409D33E954}". Action Taken: No Action Taken. Entry "HKCR\SpyDoctor.QuarantinedItemProxy" refers to invalid object "{C2CE6266-0404-4C54-96B4-8829852E3537}". Action Taken: No Action Taken. Entry "HKCR\SpyDoctor.ScripterProxy" refers to invalid object "{9FEF02F5-B3B8-4D7B-8939-72A1C989D1B9}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\YBIOCtrl.CompanionBHO.3" refers to invalid object "{02478D28-C3F9-4efb-9B51-7695ECA05670}". Action Taken: No Action Taken. File C:\WINNT\system32\csrs(2).dll infected by "Trojan-Spy.Win32.SCKeyLog.o" Virus! Action Taken: No Action Taken. File C:\WINNT\system32\File.zip infected by "Email-Worm.Win32.Wurmark.l" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\133480.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\2ea517fd.exe infected by "Trojan-Downloader.Win32.Swizzor.by" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\344618f7.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\3a991f61.exe infected by "Trojan-Downloader.Win32.Swizzor.bn" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\3ee7f023.exe infected by "Trojan-Downloader.Win32.Swizzor.bx" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\app36.tmp infected by "Trojan-Downloader.Win32.Keenval" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\app3D.tmp infected by "Trojan-Downloader.Win32.Turown.h" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\eb1e998.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\ef0f8d0.exe infected by "Trojan-Downloader.Win32.Swizzor.by" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\f3bc993.exe infected by "Trojan-Downloader.Win32.Swizzor.by" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\mpkdgzvi.exe tagged as "not-a-virus:AdWare.Lop.e". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\pacificpokersetup.exe tagged as not-a-virus:Tool.Win32.PrcView.3725. No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\perfectnavUninstall.exe infected by "Trojan-Downloader.Win32.Keenval.f" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\SaveInstWs.exe infected by "Trojan-Downloader.Win32.Small.kl" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\sta14.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\sta2E.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\temp.frF672 tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\tjoehjib.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\tvm.upd tagged as "not-a-virus:AdWare.TotalVelocity.v". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\upd6.tmp tagged as "not-a-virus:AdWare.MediaPops.b". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\wu.exe tagged as "not-a-virus:AdWare.SaveNow.z". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~1323.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~23829.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~265875.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~302056.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~356740.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~448224.tmp infected by "Trojan-Downloader.Win32.Wintool.d" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~464715.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~486759.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~486919.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~503362.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~503372.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~599284.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~607500.tmp tagged as "not-a-virus:AdWare.Wintol.i". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~610976.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~632411.tmp tagged as "not-a-virus:AdWare.Wintol.i". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~674907.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~676873.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~689994.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~693603.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~710821.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~727961.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~743134.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~747757.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~749149.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~763970.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~780908.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~803607.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~811326.tmp tagged as "not-a-virus:AdWare.Wintol.f". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~814663.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~815102.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~815616.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~815835.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~817212.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~817915.tmp tagged as "not-a-virus:AdWare.Wintol.f". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~818249.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~819004.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~819651.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~821108.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~821747.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~822725.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~824290.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~825893.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~826838.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~827956.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~829301.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~832178.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~848384.tmp infected by "Trojan-Downloader.Win32.Wintool.d" Virus! Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~853429.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~862535.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~874478.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~885154.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~894291.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~902033.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~902561.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~908990.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~910585.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~912313.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~919442.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~929121.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\DOCUME~1\Owner\LOCALS~1\Temp\~968966.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\133480.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\2ea517fd.exe infected by "Trojan-Downloader.Win32.Swizzor.by" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\344618f7.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\3a991f61.exe infected by "Trojan-Downloader.Win32.Swizzor.bn" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\3ee7f023.exe infected by "Trojan-Downloader.Win32.Swizzor.bx" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\app36.tmp infected by "Trojan-Downloader.Win32.Keenval" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\app3D.tmp infected by "Trojan-Downloader.Win32.Turown.h" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\eb1e998.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\ef0f8d0.exe infected by "Trojan-Downloader.Win32.Swizzor.by" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\f3bc993.exe infected by "Trojan-Downloader.Win32.Swizzor.by" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\mpkdgzvi.exe tagged as "not-a-virus:AdWare.Lop.e". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\pacificpokersetup.exe tagged as not-a-virus:Tool.Win32.PrcView.3725. No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\perfectnavUninstall.exe infected by "Trojan-Downloader.Win32.Keenval.f" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\SaveInstWs.exe infected by "Trojan-Downloader.Win32.Small.kl" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\sta14.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\sta2E.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\temp.frF672 tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\tjoehjib.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\tvm.upd tagged as "not-a-virus:AdWare.TotalVelocity.v". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\upd6.tmp tagged as "not-a-virus:AdWare.MediaPops.b". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\wu.exe tagged as "not-a-virus:AdWare.SaveNow.z". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~1323.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~23829.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~265875.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~302056.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~356740.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~448224.tmp infected by "Trojan-Downloader.Win32.Wintool.d" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~464715.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~486759.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~486919.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~503362.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~503372.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~599284.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~607500.tmp tagged as "not-a-virus:AdWare.Wintol.i". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~610976.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~632411.tmp tagged as "not-a-virus:AdWare.Wintol.i". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~674907.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~676873.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~689994.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~693603.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~710821.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~727961.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~743134.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~747757.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~749149.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~763970.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~780908.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~803607.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~811326.tmp tagged as "not-a-virus:AdWare.Wintol.f". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~814663.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~815102.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~815616.tmp infected by "Trojan-Downloader.Win32.Wintool.a" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~815835.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~817212.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~817915.tmp tagged as "not-a-virus:AdWare.Wintol.f". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~818249.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~819004.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~819651.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~821108.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~821747.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~822725.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~824290.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~825893.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~826838.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~827956.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~829301.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~832178.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~848384.tmp infected by "Trojan-Downloader.Win32.Wintool.d" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~853429.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~862535.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~874478.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~885154.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~894291.tmp tagged as "not-a-virus:AdWare.Wintol.c". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~902033.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~902561.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~908990.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~910585.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~912313.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~919442.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~929121.tmp tagged as "not-a-virus:AdWare.Wintol.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Local Settings\Temp\~968966.tmp tagged as "not-a-virus:AdWare.Wintol.d". Action Taken: No Action Taken. File C:\Program Files\Broderbund\Calendar Creator\Unlock\SSD\SS4DlxDl.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\009B3853 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\00BB5C30 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\00C23028 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\00C80421 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\0423527F infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\05E74FB5 infected by "Email-Worm.Win32.Bagle.gen" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\061C6F7C infected by "Email-Worm.Win32.Bagle.z" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\0629176D infected by "Email-Worm.Win32.Bagle.z" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\062C416A infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\07FA4217 infected by "Email-Worm.Win32.Wurmark.l" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\0C4F5A90 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\13A5405E infected by "Email-Worm.Win32.NetSky.q" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\13CC3833 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\13E70816 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\18A11EAB infected by "Email-Worm.Win32.Mydoom.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\18BF188A infected by "Email-Worm.Win32.Mydoom.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\1C087BE1 infected by "Email-Worm.Win32.Tanatos.b.dam" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\1DC77F5E infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\1F316C2F infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\217460BD infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\22043516 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\222458F2 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\222B2CEB infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\22342AE0 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\2CC63FC7 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\2D7273AB infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\2D8C438E infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\30FD1890 infected by "Email-Worm.Win32.Dumaru.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\3CC03031 infected by "Email-Worm.Win32.Dumaru.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\3D053C13 infected by "Email-Worm.Win32.NetSky.aa" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\3D8B7580 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\3E7106A8 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\3FA00148 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\45B62C42 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\467677A1 infected by "Email-Worm.Win32.NetSky.j" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\469A457A infected by "Email-Worm.Win32.NetSky.j" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\46E161AB infected by "Email-Worm.Win32.Tanatos.b.dam" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\4DAD5170 infected by "Trojan.Win32.SecondThought.b" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\54650B5F infected by "Email-Worm.Win32.Tanatos.b.dam" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\582E0285 infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\5DC34974 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\5EC53E59 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\5ECB1251 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\610D1F16 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\6AAE3F0B infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\6DE70A62 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\746A3048 infected by "Email-Worm.Win32.Dumaru.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\74872A27 infected by "Email-Worm.Win32.Dumaru.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\74945219 infected by "Email-Worm.Win32.Tanatos.b.dam" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\74AE21FC infected by "Email-Worm.Win32.Dumaru.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\75796774 infected by "Email-Worm.Win32.Dumaru.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\77B85578.exe infected by "Trojan.Win32.SecondThought.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\77C2536E.exe infected by "Trojan.Win32.SecondThought.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\77C82766.exe infected by "Trojan.Win32.SecondThought.a" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\787F0C32 infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\78963218 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\7D6C3C93 infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Norton AntiVirus\Quarantine\7F9B719D infected by "Email-Worm.Win32.NetSky.c" Virus! Action Taken: No Action Taken. File C:\Program Files\Yahoo!\Common\ycomp5_0_2_7.dll tagged as "not-a-virus:AdWare.ToolBar.Yahoo". Action Taken: No Action Taken. File C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP784\A0073794.exe infected by "Trojan-Spy.Win32.SCKeyLog.o" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP810\A0077538.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken. File C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP810\A0077542.exe infected by "Trojan-Downloader.Win32.Keenval.f" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP810\A0077547.dll infected by "Trojan-Downloader.Win32.Braidupdate.d" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP850\A0088064.exe tagged as "not-a-virus:AdWare.Lop". Action Taken: No Action Taken. File C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP850\A0088083.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP850\A0088094.exe infected by "Backdoor.Win32.Rbot.ru" Virus! Action Taken: No Action Taken. File C:\WINNT\system32\csrs(2).dll infected by "Trojan-Spy.Win32.SCKeyLog.o" Virus! Action Taken: No Action Taken. File C:\WINNT\system32\File.zip infected by "Email-Worm.Win32.Wurmark.l" Virus! Action Taken: No Action Taken.

There is nothing you can do to speed up the scans. It depends on how large your hard drive is and how much is on it. These scans take quite some time on my computer as well.

Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gkergovvlblsxqauxaqlw.us/v0NV_4…9D1qUkCvCCn.cgi
O4 - HKCU\..\Run: [PlusBrowse] C:\DOCUME~1\Owner\APPLIC~1\GPLFIL~1\info 32 manager.exe

With all other programs and browsers closed, click fix checked.


Step 2
Delete the following files:

C:\WINNT\system32\csrs(2).dll
C:\WINNT\system32\File.zip


Step 3
Open Norton Antivirus and click reports.
In quarantined items click "view report" and in the window that opens click Quarantined Items.
Highlight each line in the left column and click Delete Item from the toolbar above.
Repeat this procedure for the Backup Items.


Step 4
Download CCleaner from here to clean temp files from your computer.

• Double click on the file to start the installation of the program.
• Select your language and click OK, then next.
• Read the license agreement and click I Agree.
• Click next to use the default install location. Click Install then finish to complete installation.
• Double click the CCleaner shortcut on the desktop to start the program.
• Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
• Click Run Cleaner to run the program.
• After it has completed it's process, click Exit.

Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.


Step 5
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include a fresh mwavscan log.
Please let us know of any complications you had and how the computer is behaving.

Your new log appears clean.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.
ZoneAlarm - Free firewall program if you currently are not using one.

Here are two very good and free malware scanners:

Spybot Search and Destroy 1.4
AdAware SE v1.06
Set-up Instructions for Spybot S&D; and Adaware SE

If you have them already, check to make sure that they are the newest version.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418