Startup Programs

Howdy! I run Spy Sweeper and lately I have been getting alerts about two programs that want to install in my startup file: Here they are with the file locations: scrplandvdmfcd: C:/Documents and Settings/All Users/Application Data/Bike Name scrplan/64 Balm.exe Time Deaf: C:/Docume~1/Mark/Applic~1/Thisme~1/Ping Proxy Wave.exe I continue to deny install, but keep getting bugged about them. Are they legit or trouble? I did a couple of Google and Yahoo searches on them did not come up with anything. I also checked out a couple of Windows process sites and came up with nothing. Thanks in advance. Mark Stanford

From the names that you gave, it appears that you have a LOP infection on your computer.

Please download HijackThis from here. Save the file to your desktop.

Double click HijackThis_sfx.exe and select Unzip. When done click "OK".
Close the WinZip self Extractor window. You can now delete HijackThis_sfx.exe.

Navigate to C:\Program Files\HijackThis and double click HijackThis.exe. Click "Do a system scan and save a logfile" then post the new log as a reply to this thread.

Hello markstan and welcome to TomCoyote.

Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.zpqfxvkdihushom.org/D7HK4KschIu…AqAV5n001kB.jsp

O2 - BHO: 12Ghosts Popup-Killer - {00000000-0007-5041-4354-0020e48020af} - C:\Program Files\12Ghosts\12popup.dll (file missing)
O2 - BHO: (no name) - {2899229D-1616-97BB-4613-876BD8553F65} - C:\DOCUME~1\Mark\APPLIC~1\TONSBO~1\Okay user.exe (file missing)
O2 - BHO: (no name) - {735AD73B-8BC8-93E3-102A-9C8D1C80A7A9} - C:\PROGRA~1\TONSBO~1\Okay user.exe (file missing)
O2 - BHO: hope tray creative - {AE003527-34A4-CBDC-767D-FFA56196688D} - C:\PROGRA~1\TONSBO~1\Gpl Bias.dll (file missing)

O3 - Toolbar: 12-Popup - {00000000-0008-5041-4354-0020e48020af} - C:\Program Files\12Ghosts\12popup.dll (file missing)
O3 - Toolbar: roadthatgrid - {F50D087C-6287-8DCC-7E80-A4AB6E0D25F0} - C:\PROGRA~1\TONSBO~1\Gpl Bias.dll (file missing)

O4 - HKCU\..\Run: [time deaf] C:\DOCUME~1\Mark\APPLIC~1\THISME~1\ping proxy wave.exe

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/20987289275250ac3c20/…ip/RdxIE601.cab
O16 - DPF: {EE2589EB-7FC8-44DB-A892-573F2C4B41E0} - http://pdf.forbes.com/forbesnews/triggerne…oaderSigned.cab

With all other programs and browsers closed, click fix checked.


Step 2
Please set your computer to show all files.

• Double-click My Computer.
• Click the Tools menu, and then click Folder Options.
• Click the View tab.
• Clear "Hide file extensions for known file types."
• Under the "Hidden files" folder, select "Show hidden files and folders."
• Clear "Hide protected operating system files."
• Click Apply, and then click OK.

You will need to reverse this process when all steps are done.


Step 3
Please delete the following folders:

C:\DOCUME~1\Mark\Application Data\TONSBO~1 << Folder with name beginning with Tonsbo.
C:\DOCUME~1\Mark\Application Data\THISME~1 << Folder with name beginning with Thisme.
C:\Program Files\TONSBO~1 << Folder with name beginning with Tonsbo.

If you have any problem deleting these items, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.


Step 4
Download CCleaner from here to clean temp files from your computer.

• Double click on the file to start the installation of the program.
• Select your language and click OK, then next.
• Read the license agreement and click I Agree.
• Click next to use the default install location. Click Install then finish to complete installation.
• Double click the CCleaner shortcut on the desktop to start the program.
• Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
• Click Run Cleaner to run the program.
• After it has completed it's process, click Exit.

Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.


Step 5
Click here to download mwavscan.

• Double-click it to run it.
• Read then accept the agreement.
• Check Drive, and select all local drives, scan all files, then press 'scan'. (This may take a while and will not fix anything)
• Once it finds something, it will prompt you so click OK.
• When it is completed, anything found will be displayed in the lower pane.
• Highlight it with the mouse, copy it (CTRL+C), and paste (CTRL+V) it in your next reply.

Note : It will find many orphaned registry entries so please do not be alarmed by the amount of items that show.


Step 6
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.

Got all the info. Thanks! I am traveling this week and will be back early on Saturday. I'll follow your guidelines over the weekend and report back. Appreciate the help. Mark

I should be on most of the weekend, so I'll await your reply.

I finally got through with the mwavscan, it took about 2 hours. I followed your plan, and did have a couple of hiccups. I'll fill you in on the next post. I'll post the scan first and then the second HjackThis log. I'll be back in a bit with the HijackThis log. Thanks again for the the help - Mark Here goes: Object "emusicclient Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Quicken Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Kazoom Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\Program Files\EarthLink 5.0\atl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\batchdwnl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\msxml3a.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\News\PlayCenter2\PlayCenter21.lst". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\News\PlayCenter2\Banner\NOMADJB.IMG". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\News\PlayCenter2\Banner\NOMADJB.ini". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\News\PlayCenter2\Marquee\PDE.htm". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\News\PlayCenter2\Marquee\PDE.ini". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\EarthLink 5.0\atl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\QUICKENW\mrbUpd.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\QUICKENW\mrtProc.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Intuit\Shared\ARHELP.CNT". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\batchdwnl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{00000000-0008-5041-4354-0020e48020af}" refers to invalid object "C:\Program Files\12Ghosts\12popup.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{00FAE562-DACA-11D6-AD30-0050DAD88A02}" refers to invalid object "C:\Program Files\Kodak\Kodak Easyshare Software\bin\Escom.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{00FAE568-DACA-11D6-AD30-0050DAD88A02}" refers to invalid object "C:\Program Files\Kodak\Kodak Easyshare Software\bin\Escom.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{08CE60DE-D425-11D3-891E-00104B9876B8}" refers to invalid object "C:\WINDOWS\system32\KODAKO~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{09101CAF-D527-11D6-AD30-0050DAD88A02}" refers to invalid object "C:\Program Files\Kodak\Kodak Easyshare Software\bin\Escom.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{09101CB7-D527-11D6-AD30-0050DAD88A02}" refers to invalid object "C:\Program Files\Kodak\Kodak Easyshare Software\bin\Escom.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{09101CBA-D527-11D6-AD30-0050DAD88A02}" refers to invalid object "C:\Program Files\Kodak\Kodak Easyshare Software\bin\Escom.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{09101CBE-D527-11D6-AD30-0050DAD88A02}" refers to invalid object "C:\Program Files\Kodak\Kodak Easyshare Software\bin\Escom.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0C8903E0-E32F-4035-B798-50C0BBCA42B6}" refers to invalid object "C:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{17580E5F-7B07-11D2-BF1F-00A024D73444}" refers to invalid object "C:\Program Files\Symantec\LiveUpdate\ProductRegCom_2_5.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1CEFD16C-91C2-4953-986E-EE77DE2DCF94}" refers to invalid object "C:\Program Files\Symantec\LiveUpdate\NetDetectController_2_5.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{2045EFE5-99CF-11D2-B40A-00600831DD76}" refers to invalid object "C:\Program Files\Symantec\LiveUpdate\ProductRegCom_2_5.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{33CE799A-0E69-4f81-8F78-E3246771513B}" refers to invalid object "C:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{56336BCA-3D8A-11d6-A00B-0050DA18DE71}" refers to invalid object "C:\DOCUME~1\Sunny\LOCALS~1\Temp\InfoWindow.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{6628157E-EBAB-4c1d-A3DB-468DB60F890D}" refers to invalid object "C:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{6CDBA7CE-C3A4-4548-8D60-118EED9C24A4}" refers to invalid object "C:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{6E7267D0-D09D-11D2-8488-00105A26DF2D}" refers to invalid object "C:\QUICKE~1\QIHNDLR.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}" refers to invalid object "I:\PortableThunderbird\thunderbird\MapiProxy.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\Program Files\Messenger\rtcimsp.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{99EEC57E-4532-4d00-98AB-43D7C8D07755}" refers to invalid object "C:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CDE0A580-A4A0-4C34-B375-DAB4832FC0AB}" refers to invalid object "C:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F50D087C-6287-8DCC-7E80-A4AB6E0D25F0}" refers to invalid object "C:\PROGRA~1\TONSBO~1\Gpl Bias.dll". Action Taken: No Action Taken. Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken. Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken. Entry "HKCR\AOLCoach.TrainerOCXCtrl" refers to invalid object "{e04eae82-14ad-41cb-bf5a-45556abb8347}". Action Taken: No Action Taken. Entry "HKCR\Automap.Map.NA" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken. Entry "HKCR\Automap.Map.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken. Entry "HKCR\Automap.Template.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken. Entry "HKCR\eSellerateControl.350" refers to invalid object "{25982EAA-87CC-4747-BE09-9913CF7DD2F1}". Action Taken: No Action Taken. Entry "HKCR\eSellerateControl.350.1" refers to invalid object "{25982EAA-87CC-4747-BE09-9913CF7DD2F1}". Action Taken: No Action Taken. Entry "HKCR\JavaPlugin" refers to invalid object "{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}". Action Taken: No Action Taken. Entry "HKCR\JavaPlugin.150_01" refers to invalid object "{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}". Action Taken: No Action Taken. Entry "HKCR\JavaWebStart.isInstalled" refers to invalid object "{5852F5ED-8BF4-11D4-A245-0080C6F74284}". Action Taken: No Action Taken. Entry "HKCR\JavaWebStart.isInstalled.1.5.0.0" refers to invalid object "{5852F5ED-8BF4-11D4-A245-0080C6F74284}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken. Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken. Entry "HKCR\WMPShell.HWEventHandler" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken. Entry "HKCR\WMPShell.HWEventHandler.1" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken. Entry "HKCR\XceedSoftware.XceedCompression" refers to invalid object "{4C836512-BB70-11D2-A5A7-00105A9C91C6}". Action Taken: No Action Taken. Entry "HKCR\XceedSoftware.XceedCompression.5" refers to invalid object "{4C836512-BB70-11D2-A5A7-00105A9C91C6}". Action Taken: No Action Taken. Entry "HKCR\XceedSoftware.XceedZip" refers to invalid object "{DB797690-40E0-11D2-9BD5-0060082AE372}". Action Taken: No Action Taken. Entry "HKCR\XceedSoftware.XceedZip.5" refers to invalid object "{DB797690-40E0-11D2-9BD5-0060082AE372}". Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\64 Balm.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Anti Multi.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\BarbOne.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\BendPoll.exe tagged as "not-a-virus:AdWare.Lop.j". Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\BIN WAVE.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\binglobal.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\BOLD ROAD.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Boob Bows.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\cast burn.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\city media.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\creative file.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Dale active.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Flag Team.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\funk corn.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\help build.exe infected by "Trojan-Downloader.Win32.Swizzor.df" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Keepscr.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Lies Close.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Lite knob.exe tagged as "not-a-virus:AdWare.Lop.p". Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Lite open.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\once rule.exe infected by "Trojan.Win32.Krepper.ab" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\pingcdrom.exe tagged as "not-a-virus:AdWare.Lop.j". Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Plus funk.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Sendanti.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\TestView.exe tagged as "not-a-virus:AdWare.Lop.j". Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\thunkitch.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\title idol.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\tooltick.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\TransBurn.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\TypeList.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan\Vgadate.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\WNS6F26M\upAYB[1].int infected by "Trojan-Downloader.Win32.Swizzor.di" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\Mozilla\Profiles\default\6qjxn4ie.slt\Mail\Local Folders\Outlook Express Mail.sbd\Deleted Items tagged as "not-a-virus:PSWTool.HTML.Fraud.gen". Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\Mozilla\Profiles\default\6qjxn4ie.slt\Mail\Local Folders\Outlook Express Mail.sbd\Sent Items tagged as "not-a-virus:PSWTool.HTML.Fraud.gen". Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\Mozilla\Profiles\default\6qjxn4ie.slt\Mail\mail.adelphia-2.net\Inbox tagged as "not-a-virus:PSWTool.HTML.Fraud.gen". Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\ascphbol.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\dkhoylgs.exe infected by "Trojan-Downloader.Win32.Swizzor.df" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\effmtssh.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\ekmnkhiw.exe tagged as "not-a-virus:AdWare.Lop.j". Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\rabobqii.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\sewgpvfr.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\thzqjbba.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\udejeeob.exe tagged as "not-a-virus:AdWare.Lop.p". Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\vcmqffsy.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\xeaxpvxy.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\xxsdtzpy.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Application Data\This Media\ybgbbljx.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus! Action Taken: No Action Taken. File C:\Documents and Settings\Sunny\Local Settings\Temp\wcondlqd.exe infected by "Trojan-Downloader.Win32.Swizzor.dp" Virus! Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\This Media\fbtvvgow.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\This Media\ltujbnuu.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\This Media\vfdeqxlg.exe infected by "Trojan-Downloader.Win32.Swizzor.de" Virus! Action Taken: No Action Taken.

Step 1
I need you to disable SpySweeper until after the computer is clean as it will interfere with the registry changes we will need to do.

• Open SpySweeper click > Options over to the left then > program options > Uncheck "load at windows startup".
• Over to the left click "shields" and uncheck all there.
• Uncheck "home page shield".
• Uncheck 'automatically restore default without notification".

Step 2
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.zpqfxvkdihushom.org/D7HK4KschIu…AqAV5n001kB.jsp

With all other programs and browsers closed, click fix checked.


Step 3
Please set your computer to show all files.

• Double-click My Computer.
• Click the Tools menu, and then click Folder Options.
• Click the View tab.
• Clear "Hide file extensions for known file types."
• Under the "Hidden files" folder, select "Show hidden files and folders."
• Clear "Hide protected operating system files."
• Click Apply, and then click OK.

You will need to reverse this process when all steps are done.


Step 4
Please delete the following folders:

C:\Documents and Settings\All Users\Application Data\Bike Name Scr Plan
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\WNS6F26M
C:\Documents and Settings\Sunny\Application Data\This Media
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\This Media

If you have any problem deleting these items, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.


Step 5
Run CCleaner to clean temp files from your computer.

• Double click the CCleaner shortcut on the desktop to start the program.
• Click Run Cleaner to run the program.
• After it has completed it's process, click Exit.

Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.


Step 6
Open notepad and copy and paste the following text into it:

dir %Windir%\tasks /a h > files.txt
notepad files.txt

Save this as findjobs.bat, choose to save it as *all files* and place it on your desktop.

Doubleclick on findjobs.bat and post the content of the textfile you get in your next reply.


Step 7
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include the results of findjobs.bat.
Please let us know of any complications you had and how the computer is behaving.

Alan; I have not had a chance to do the stuff in the last post. I am home again and want to do it early Saturday. Will you be around for help? Thanks again for your efforts. Mark

I will be on some of the day on Saturday. Have a few errands to run during the day. This time of day is when I am most active on the Internet.

I deleted the "This Media" folder in c:\D&S\Sunny\Application Data and in c:\windows\system32\config\systemprofile\application data but also noticed a "Tons Body" folder in both locations. I did not delete them but am wondering if I probably should have.

Please delete those folders as well.

Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pqnduhqatqwksa.com/D7HK4KschIuQ…gqAV5n001kB.jpg

With all other programs and browsers closed, click fix checked.


Step 2
Open notepad and copy and paste the following text into it:

%systemdrive%
cd C:\WINDOWS\Tasks
attrib -r -s -h A89E82CB91913BDF.job
del A89E82CB91913BDF.job
attrib -r -s -h AA0A3432919DA4FE.job
del AA0A3432919DA4FE.job
attrib -r -s -h AABEC57791697AA3.job
del AABEC57791697AA3.job
attrib -r -s -h AD75DEFA91A655DE.job
del AD75DEFA91A655DE.job
attrib -r -s -h AF8B93C39184050B.job
del AF8B93C39184050B.job

Save this as remjob.bat, choose to save it as *all files* and place it on your desktop.

Doubleclick on remjob.bat. A doswindow will open and close again, this is normal.

Afterwards, doubleclick on findjobs.bat again and paste the content of the txtfile you get in your next reply.


Step 3
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include the results of the new findjobs.bat.
Please let us know of any complications you had and how the computer is behaving.

Your new log appears clean.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

Update these regularly.

You may also want to read "So how did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.