Hijack Log Full page pop up ads

Tue Dec 20 02:58:49 2005 => ***** Scanning C:\WINDOWS\All Users\Start Menu\Programs\StartUp Folder ***** Tue Dec 20 02:58:49 2005 => Scanning Folder: C:\WINDOWS\All Users\Start Menu\Programs\StartUp\*.* Tue Dec 20 02:58:49 2005 => ***** Scanning Service Files ***** Tue Dec 20 02:58:49 2005 => Scanning HKLM\SYSTEM\CurrentControlSet\Services Tue Dec 20 02:58:49 2005 => Scanning File C:\WINDOWS\System32\Drivers\wdmfs.sys Tue Dec 20 02:58:49 2005 => Scanning File C:\WINDOWS\SYSTEM\PSTORES.EXE Tue Dec 20 02:58:49 2005 => Scanning HKLM\SYSTEM\CurrentControlSet\Services\VxD Tue Dec 20 02:58:49 2005 => Scanning File C:\WINDOWS\SYSTEM\vnetsup.vxd Tue Dec 20 02:58:50 2005 => Scanning File C:\WINDOWS\SYSTEM\ndis.vxd Tue Dec 20 02:58:50 2005 => Scanning File C:\WINDOWS\SYSTEM\JAVASUP.VXD Tue Dec 20 02:58:50 2005 => Scanning File c:\windows\SYSTEM\vrtwd.386 Tue Dec 20 02:58:50 2005 => Scanning File c:\windows\SYSTEM\vfixd.vxd Tue Dec 20 02:58:50 2005 => Scanning File C:\WINDOWS\SYSTEM\vnetbios.vxd Tue Dec 20 02:58:50 2005 => Scanning File C:\WINDOWS\SYSTEM\MRTRATE.VXD Tue Dec 20 02:58:50 2005 => Scanning File C:\WINDOWS\SYSTEM\vredir.vxd Tue Dec 20 02:58:50 2005 => Scanning File C:\WINDOWS\SYSTEM\dfs.vxd Tue Dec 20 02:58:50 2005 => Scanning File C:\WINDOWS\SYSTEM\VgartD.VxD Tue Dec 20 02:58:51 2005 => Scanning File C:\WINDOWS\SYSTEM\ASPIENUM.VXD Tue Dec 20 02:58:51 2005 => Scanning File C:\PROGRA~1\GRISOFT\AVGFRE~1\AVG7CORE.VXD Tue Dec 20 02:58:51 2005 => Scanning File C:\PROGRA~1\GRISOFT\AVGFRE~1\AVG7RS.VXD Tue Dec 20 02:58:51 2005 => Scanning File C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGTDI.VXD Tue Dec 20 02:58:51 2005 => ***** Scanning Registry and File system for Adware/Spyware ***** Tue Dec 20 02:58:51 2005 => Loading Spyware Signatures from new External Database (Size: 146155). Tue Dec 20 02:59:18 2005 => Indexed Spyware Databases Successfully Created… Tue Dec 20 03:26:50 2005 => System found infected with dogpile toolbar Spyware/Adware ({5e92f538-b50b-46c5-9c5f-c6eeced3f6c6})! Action taken: No Action Taken. Tue Dec 20 03:26:57 2005 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\weatherbug !!! Tue Dec 20 03:26:57 2005 => Object "weatherbug Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:26:57 2005 => Offending Key found: HKCU\Software\funwebproducts !!! Tue Dec 20 03:26:57 2005 => Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:27:01 2005 => Offending Folder found: C:\WINDOWS\DOWNLO~1\conflict.1 Tue Dec 20 03:27:01 2005 => Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:27:01 2005 => Offending file found: C:\WINDOWS\TEMP\tbinstall.log Tue Dec 20 03:27:01 2005 => System found infected with blowsearch Spyware/Adware (tbinstall.log)! Action taken: No Action Taken. Tue Dec 20 03:27:01 2005 => Offending file found: C:\WINDOWS\TEMP\insthelp.dll Tue Dec 20 03:27:01 2005 => System found infected with redv Spyware/Adware (insthelp.dll)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\98.zip\skin_js.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (skin_js.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\98.zip\loader.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (loader.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\109.zip\skin_js.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (skin_js.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\109.zip\loader.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (loader.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\120.zip\skin_js.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (skin_js.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\120.zip\loader.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (loader.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\ide21201.vxd Tue Dec 20 03:27:02 2005 => System found infected with windupdate Spyware/Adware (ide21201.vxd)! Action taken: No Action Taken. Tue Dec 20 03:27:03 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\49ij0hi7\ads[1].htm Tue Dec 20 03:27:03 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:03 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\49ij0hi7\ads[2].htm Tue Dec 20 03:27:03 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\wud3p1yt\ads[1].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\wud3p1yt\ads[2].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\aln4erhn\ads[1].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\aln4erhn\ads[2].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\aln4erhn\formie[1].css Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (formie[1].css)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\3an0u5gl\formie[1].css Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (formie[1].css)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\3an0u5gl\ads[1].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\3an0u5gl\ads[2].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:05 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\3an0u5gl\blank[1].htm Tue Dec 20 03:27:05 2005 => System found infected with whenu.savenow Spyware/Adware (blank[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:07 2005 => Offending file found: c:\windows\TEMP\tbinstall.log Tue Dec 20 03:27:07 2005 => System found infected with blowsearch Spyware/Adware (tbinstall.log)! Action taken: No Action Taken. Tue Dec 20 03:27:07 2005 => Offending file found: c:\windows\TEMP\insthelp.dll Tue Dec 20 03:27:07 2005 => System found infected with redv Spyware/Adware (insthelp.dll)! Action taken: No Action Taken. Tue Dec 20 03:27:08 2005 => Offending file found: c:\windows\TEMP\ide21201.vxd Tue Dec 20 03:27:08 2005 => System found infected with windupdate Spyware/Adware (ide21201.vxd)! Action taken: No Action Taken. Tue Dec 20 03:27:08 2005 => Offending file found: C:\WINDOWS\Desktop\l2m9xfix\sed.exe Tue Dec 20 03:27:08 2005 => System found infected with ezula Spyware/Adware (sed.exe)! Action taken: No Action Taken. Tue Dec 20 03:27:11 2005 => Offending Folder found: C:\WINDOWS\Start Menu\programs\weatherbug Tue Dec 20 03:27:11 2005 => Object "weatherbug Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:27:12 2005 => Offending Folder found: C:\WINDOWS\Start Menu\Programs\weatherbug Tue Dec 20 03:27:12 2005 => Object "weatherbug Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:27:14 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\iyn9ahfj\ads[1].htm Tue Dec 20 03:27:14 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\iyn9ahfj\ads[2].htm Tue Dec 20 03:27:15 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\iyn9ahfj\global[1].js Tue Dec 20 03:27:15 2005 => System found infected with redv Spyware/Adware (global[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\2cje9m5i\ads[1].htm Tue Dec 20 03:27:15 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\2cje9m5i\ads[2].htm Tue Dec 20 03:27:15 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\2cje9m5i\formie[1].css Tue Dec 20 03:27:15 2005 => System found infected with whenu.savenow Spyware/Adware (formie[1].css)! Action taken: No Action Taken. Tue Dec 20 03:27:16 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\3td03wy5\ads[2].htm Tue Dec 20 03:27:16 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:17 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\3td03wy5\misc[1].js Tue Dec 20 03:27:17 2005 => System found infected with whenu.savenow Spyware/Adware (misc[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:17 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\rgz07ho7\ads[2].htm Tue Dec 20 03:27:17 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:18 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\8rfb1p3w\ads[1].htm Tue Dec 20 03:27:18 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:18 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\8rfb1p3w\global[1].js Tue Dec 20 03:27:18 2005 => System found infected with redv Spyware/Adware (global[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:19 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\v6fgf9ea\ads[1].htm Tue Dec 20 03:27:19 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:19 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\v6fgf9ea\ads[2].htm Tue Dec 20 03:27:19 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:20 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\opmzchy3\s_code[1].js Tue Dec 20 03:27:20 2005 => System found infected with whenu.savenow Spyware/Adware (s_code[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:21 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\opmzchy3\misc[1].js Tue Dec 20 03:27:21 2005 => System found infected with whenu.savenow Spyware/Adware (misc[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:21 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\g6r41u7n\ads[1].htm Tue Dec 20 03:27:21 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:21 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\g6r41u7n\formie[1].css Tue Dec 20 03:27:21 2005 => System found infected with whenu.savenow Spyware/Adware (formie[1].css)! Action taken: No Action Taken. Tue Dec 20 03:27:21 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\g6r41u7n\ads[2].htm Tue Dec 20 03:27:21 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:22 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\s71jambd\ads[1].htm Tue Dec 20 03:27:22 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:23 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\uxgbqjgf\ads[2].htm Tue Dec 20 03:27:23 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:24 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\pagu3h1k\s_code[1].js Tue Dec 20 03:27:24 2005 => System found infected with whenu.savenow Spyware/Adware (s_code[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:25 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\dx5zaury\blank[1].htm Tue Dec 20 03:27:25 2005 => System found infected with whenu.savenow Spyware/Adware (blank[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:25 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\dx5zaury\show_ads[2].js Tue Dec 20 03:27:25 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken. Tue Dec 20 03:27:26 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\dx5zaury\global[1].js Tue Dec 20 03:27:26 2005 => System found infected with redv Spyware/Adware (global[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:26 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\dx5zaury\s_code[1].js Tue Dec 20 03:27:26 2005 => System found infected with whenu.savenow Spyware/Adware (s_code[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:35 2005 => ***** Scanning Registry for errors created because of Adware/Spyware ***** Tue Dec 20 03:27:35 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken. Tue Dec 20 03:27:35 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\PopupSh.ocx". Action Taken: No Action Taken. Tue Dec 20 03:27:37 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\PopupSh.ocx". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Enc2000.exe" refers to invalid object "". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ERS2000.exe" refers to invalid object "". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\BackWeb.exe" refers to invalid object "C:\Program Files\BackWeb\BackWeb\PROGRAM\BackWeb.exe". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\InstallHelper.exe" refers to invalid object "". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\MotiveSB.exe" refers to invalid object "C:\PROGRA~1\VERIZO~1\SMARTB~1". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SmartBridge.exe" refers to invalid object "C:\PROGRA~1\VERIZO~1\SMARTB~1". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Verizon Broadband Toolbar" refers to invalid object "C:\Program Files\Common Files\Verizon Online\SFP\Verizon Broadband Toolbar". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\aupdate.dll" refers to invalid object "". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ENGINE.DLL" refers to invalid object "C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL\ENGINE.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:38 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "c:\windows\TEMP\~mdactyp\". Action Taken: No Action Taken. Tue Dec 20 03:27:41 2005 => Entry "HKCR\CLSID\{DDBABFC0-2648-11D2-BC64-00104B2CF71C}" refers to invalid object "C:\WINDOWS\SYSTEM\WBEM\CIMW32EX.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:42 2005 => Entry "HKCR\CLSID\{53FCF358-5323-11D0-A864-0000B43699FC}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BACKWEB.EXE". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{608FE361-6FB2-11D1-A885-0000B43699FC}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWFILES.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{3AF78A6F-6F14-11D1-A884-0000B43699FC}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWFILES.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{DB1C624A-0F4B-11D2-8F62-00609773422E}" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\BWCHAN~1.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{DB1C6249-0F4B-11D2-8F62-00609773422E}" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\BWCHAN~1.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{64B11B89-0147-11D2-8F62-00609773422E}" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\BWCHAN~2.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{64B11B88-0147-11D2-8F62-00609773422E}" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\BWCHAN~2.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{27443470-FC66-11D1-8F62-00609773422E}" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\BWSTOR~1.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{2744346F-FC66-11D1-8F62-00609773422E}" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\BWSTOR~1.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{F3B932E9-02E6-11D2-8F62-E4DCC9447050}" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\BWSTOR~2.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{F3B932E8-02E6-11D2-8F62-E4DCC9447050}" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\BWSTOR~2.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{B738B059-B74F-11D1-AA87-0000B43695BE}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\FRCOM.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{B738B05B-B74F-11D1-AA87-0000B43695BE}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\FRCOM.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:43 2005 => Entry "HKCR\CLSID\{BF1D9E28-C162-11D1-AA87-0000B43695BE}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\FREXT.EXE". Action Taken: No Action Taken. Tue Dec 20 03:27:44 2005 => Entry "HKCR\CLSID\{390CE9F2-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\PROGRAM FILES\YAHOO!\MESSENGER\YCRWIN32.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:44 2005 => Entry "HKCR\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\PROGRAM FILES\YAHOO!\MESSENGER\ASW.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7F}" refers to invalid object "C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7E}" refers to invalid object "C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}" refers to invalid object "C:\WINDOWS\DOWNLOADED PROGRAM FILES\POPCAPLOADER.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{C7976BEB-AB1E-46F7-8CCD-D4C9CD83BF49}" refers to invalid object "C:\PROGRA~1\SPYWAR~1\SWDOCTOR.EXE". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\WEBDRIVER.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\WTHOSTCTL.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{0c097121-c5d6-47eb-841d-30bff71a71c4}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\WTMULTI.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\WTWMPLUG.AX". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\WTWMPLUG.AX". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\SOUND.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\SOUND.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:51 2005 => Entry "HKCR\CLSID\{DCA9F79B-903A-456D-847D-43A2EFE0476B}" refers to invalid object "C:\PROGRAM FILES\DOGPILETOOLBAR\CURSORSEARCHWORD.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\CLSID\{8EC31898-D1E6-4758-80BE-31E873AC2903}" refers to invalid object "C:\Program Files\Grisoft\AVG Free\avgamui.dll". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\CLSID\{8EC31897-D1E6-4758-80BE-31E873AC2903}" refers to invalid object "C:\Program Files\Grisoft\AVG Free\avgamui.dll". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\CLSID\{D9C027CF-DF75-4D2C-B763-AC1CA31C4AF8}" refers to invalid object "C:\Program Files\Grisoft\AVG Free\avgamiui.dll". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{00025E04-0000-0000-C000-000000000046}" refers to invalid object "c:\Program Files\Common Files\Microsoft Shared\Dao\dao2535.tlb". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{53FCF357-5323-11D0-A864-0000B43699FC}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BACKWEB.EXE". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{3AF78A60-6F14-11D1-A884-0000B43699FC}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWFILES.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{DB1C6246-0F4B-11D2-8F62-00609773422E}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWCHANNELDIRECTORY.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{64B11B85-0147-11D2-8F62-00609773422E}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWCHANNELDROPDOWN.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{2744346C-FC66-11D1-8F62-00609773422E}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWSTORYLIST.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{F3B932E5-02E6-11D2-8F62-E4DCC9447050}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWSTORYSUMMARY.OCX". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{B738B04B-B74F-11D1-AA87-0000B43695BE}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\FRCOM.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{97972D22-C259-11D1-AA87-0000B43695BE}" refers to invalid object "C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\FREXT.EXE". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{390CE9E4-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\PROGRAM FILES\YAHOO!\MESSENGER\YCRWIN32.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:52 2005 => Entry "HKCR\TypeLib\{41695A81-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\PROGRAM FILES\YAHOO!\MESSENGER\ASW.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:53 2005 => Entry "HKCR\TypeLib\{8A1AB044-787D-4309-8410-709768E484AB}" refers to invalid object "C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YPUBC.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:53 2005 => Entry "HKCR\TypeLib\{C9C5DEAF-0A1F-4660-8279-9EDFAD6FEFE1}" refers to invalid object "C:\WINDOWS\DOWNLOADED PROGRAM FILES\POPCAPLOADER.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:53 2005 => Entry "HKCR\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\WEBDRIVER.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:53 2005 => Entry "HKCR\TypeLib\{B7E20302-C22C-4AF2-9D75-C3EB6EEE9DD8}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\WTHOSTCTL.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:53 2005 => Entry "HKCR\TypeLib\{B162D478-EF46-4475-B1FE-216BDEDB7FAD}" refers to invalid object "C:\WINDOWS\WT\WEBDRIVER\4.1.1\WTMULTI.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:53 2005 => Entry "HKCR\TypeLib\{55A59FFC-65F0-4995-93BA-D03EAA16443D}" refers to invalid object "C:\PROGRAM FILES\DOGPILETOOLBAR\CURSORSEARCHWORD.DLL". Action Taken: No Action Taken. Tue Dec 20 03:27:54 2005 => Entry "HKCR\.ppt" refers to invalid object "Powerpoint.Show.7". Action Taken: No Action Taken. Tue Dec 20 03:27:54 2005 => Entry "HKCR\.POT" refers to invalid object "Powerpoint.Template". Action Taken: No Action Taken. Tue Dec 20 03:27:55 2005 => Entry "HKCR\TSHOOT.TSHOOTCtrl.1" refers to invalid object "{4B106874-DD36-11D0-8B44-00A024DD9EFF}". Action Taken: No Action Taken. Tue Dec 20 03:27:57 2005 => Entry "HKCR\iadfile\shell\open\command" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\REGISTER.EXE "%1"". Action Taken: No Action Taken. Tue Dec 20 03:27:57 2005 => Entry "HKCR\bwpfile\shell\open\command" refers to invalid object "C:\PROGRA~1\BACKWEB\BACKWEB\PROGRAM\PRVCNT.EXE "%1"". Action Taken: No Action Taken. Tue Dec 20 03:28:02 2005 => Entry "HKCR\arkapp\shell\open\command" refers to invalid object "C:\PROGRAM FILES\WINSTONPOKER\WINSTONPOKER.EXE %1". Action Taken: No Action Taken. Tue Dec 20 03:28:04 2005 => Entry "HKCR\vzbb.VZBB" refers to invalid object "{4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D}". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\SpyDoctor.EBankProblem" refers to invalid object "{AE612304-E8F9-45D9-A444-32409D33E954}". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\SpyDoctor.ScripterProxy" refers to invalid object "{9FEF02F5-B3B8-4D7B-8939-72A1C989D1B9}". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\SpyDoctor.QuarantinedItemProxy" refers to invalid object "{C2CE6266-0404-4C54-96B4-8829852E3537}". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\.exe_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\.bat_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\.pif_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:05 2005 => Entry "HKCR\.vbs_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.com_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.chm_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.cpl_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.hta_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.inf_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.ins_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.js_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.jse_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.msc_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.msi_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.msp_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.reg_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.scr_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.sct_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.shs_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.vbe_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.vb_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.wsc_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.wsf_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.wsh_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.isp_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.mda_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.mdb_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.mde_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.ade_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.adp_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.mdz_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.prf_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.dbx_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.crt_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.shb_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.lnk_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.scf_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.asx_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.cmd_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.hlp_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.doc_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken. Tue Dec 20 03:28:06 2005 => Entry "HKCR\.xls_aq" refers to invalid object "SafeFiles.1". Action Taken: No Action Taken.

I don't know if you want the full log or not..Its pretty big. I will stop posting right now and you let me know if you want the whole log. Here is the end of it: Tue Dec 20 03:48:30 2005 => ***** Scanning complete. ***** Tue Dec 20 03:48:30 2005 => Total Objects Scanned: 31543 Tue Dec 20 03:48:30 2005 => Total Virus(es) Found: 57 Tue Dec 20 03:48:30 2005 => Total Disinfected Files: 0 Tue Dec 20 03:48:30 2005 => Total Files Renamed: 0 Tue Dec 20 03:48:30 2005 => Total Deleted Objects: 0 Tue Dec 20 03:48:30 2005 => Total Errors: 118 Tue Dec 20 03:48:30 2005 => Time Elapsed: 00:57:16 Tue Dec 20 03:48:30 2005 => Virus Database Date: 2005/12/12 Tue Dec 20 03:48:30 2005 => Virus Database Count: 164615 Tue Dec 20 03:48:30 2005 => Scan Completed.

Here are the directions for MWav:

Please download the free MWAV antivirus tool from here. Save it to the desktop and run it. Follow the prompts to scan your system for viruses. Then please post for me the log of infected files from the BOTTOM panel of the scan window. Please remove any lines relating to "Invalid object" as they are not needed at this time.

It wouldn't let me cut, copy and paste the bottom part of the log..But here is what was there. ***** Scanning Registry and File system for Adware/Spyware ***** Tue Dec 20 02:58:51 2005 => Loading Spyware Signatures from new External Database (Size: 146155). Tue Dec 20 02:59:18 2005 => Indexed Spyware Databases Successfully Created… Tue Dec 20 03:26:50 2005 => System found infected with dogpile toolbar Spyware/Adware ({5e92f538-b50b-46c5-9c5f-c6eeced3f6c6})! Action taken: No Action Taken. Tue Dec 20 03:26:57 2005 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\weatherbug !!! Tue Dec 20 03:26:57 2005 => Object "weatherbug Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:26:57 2005 => Offending Key found: HKCU\Software\funwebproducts !!! Tue Dec 20 03:26:57 2005 => Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:27:01 2005 => Offending Folder found: C:\WINDOWS\DOWNLO~1\conflict.1 Tue Dec 20 03:27:01 2005 => Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:27:01 2005 => Offending file found: C:\WINDOWS\TEMP\tbinstall.log Tue Dec 20 03:27:01 2005 => System found infected with blowsearch Spyware/Adware (tbinstall.log)! Action taken: No Action Taken. Tue Dec 20 03:27:01 2005 => Offending file found: C:\WINDOWS\TEMP\insthelp.dll Tue Dec 20 03:27:01 2005 => System found infected with redv Spyware/Adware (insthelp.dll)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\98.zip\skin_js.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (skin_js.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\98.zip\loader.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (loader.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\109.zip\skin_js.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (skin_js.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\109.zip\loader.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (loader.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\120.zip\skin_js.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (skin_js.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\120.zip\loader.js Tue Dec 20 03:27:02 2005 => System found infected with broadcastpc Spyware/Adware (loader.js)! Action taken: No Action Taken. Tue Dec 20 03:27:02 2005 => Offending file found: C:\WINDOWS\TEMP\ide21201.vxd Tue Dec 20 03:27:02 2005 => System found infected with windupdate Spyware/Adware (ide21201.vxd)! Action taken: No Action Taken. Tue Dec 20 03:27:03 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\49ij0hi7\ads[1].htm Tue Dec 20 03:27:03 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:03 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\49ij0hi7\ads[2].htm Tue Dec 20 03:27:03 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\wud3p1yt\ads[1].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\wud3p1yt\ads[2].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\aln4erhn\ads[1].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\aln4erhn\ads[2].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\aln4erhn\formie[1].css Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (formie[1].css)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\3an0u5gl\formie[1].css Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (formie[1].css)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\3an0u5gl\ads[1].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:04 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\3an0u5gl\ads[2].htm Tue Dec 20 03:27:04 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:05 2005 => Offending file found: C:\WINDOWS\TEMP\temporary internet files\content.ie5\3an0u5gl\blank[1].htm Tue Dec 20 03:27:05 2005 => System found infected with whenu.savenow Spyware/Adware (blank[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:07 2005 => Offending file found: c:\windows\TEMP\tbinstall.log Tue Dec 20 03:27:07 2005 => System found infected with blowsearch Spyware/Adware (tbinstall.log)! Action taken: No Action Taken. Tue Dec 20 03:27:07 2005 => Offending file found: c:\windows\TEMP\insthelp.dll Tue Dec 20 03:27:07 2005 => System found infected with redv Spyware/Adware (insthelp.dll)! Action taken: No Action Taken. Tue Dec 20 03:27:08 2005 => Offending file found: c:\windows\TEMP\ide21201.vxd Tue Dec 20 03:27:08 2005 => System found infected with windupdate Spyware/Adware (ide21201.vxd)! Action taken: No Action Taken. Tue Dec 20 03:27:08 2005 => Offending file found: C:\WINDOWS\Desktop\l2m9xfix\sed.exe Tue Dec 20 03:27:08 2005 => System found infected with ezula Spyware/Adware (sed.exe)! Action taken: No Action Taken. Tue Dec 20 03:27:11 2005 => Offending Folder found: C:\WINDOWS\Start Menu\programs\weatherbug Tue Dec 20 03:27:11 2005 => Object "weatherbug Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:27:12 2005 => Offending Folder found: C:\WINDOWS\Start Menu\Programs\weatherbug Tue Dec 20 03:27:12 2005 => Object "weatherbug Spyware/Adware" found in File System! Action Taken: No Action Taken. Tue Dec 20 03:27:14 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\iyn9ahfj\ads[1].htm Tue Dec 20 03:27:14 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\iyn9ahfj\ads[2].htm Tue Dec 20 03:27:15 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\iyn9ahfj\global[1].js Tue Dec 20 03:27:15 2005 => System found infected with redv Spyware/Adware (global[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\2cje9m5i\ads[1].htm Tue Dec 20 03:27:15 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\2cje9m5i\ads[2].htm Tue Dec 20 03:27:15 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:15 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\2cje9m5i\formie[1].css Tue Dec 20 03:27:15 2005 => System found infected with whenu.savenow Spyware/Adware (formie[1].css)! Action taken: No Action Taken. Tue Dec 20 03:27:16 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\3td03wy5\ads[2].htm Tue Dec 20 03:27:16 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:17 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\3td03wy5\misc[1].js Tue Dec 20 03:27:17 2005 => System found infected with whenu.savenow Spyware/Adware (misc[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:17 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\rgz07ho7\ads[2].htm Tue Dec 20 03:27:17 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:18 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\8rfb1p3w\ads[1].htm Tue Dec 20 03:27:18 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:18 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\8rfb1p3w\global[1].js Tue Dec 20 03:27:18 2005 => System found infected with redv Spyware/Adware (global[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:19 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\v6fgf9ea\ads[1].htm Tue Dec 20 03:27:19 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:19 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\v6fgf9ea\ads[2].htm Tue Dec 20 03:27:19 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:20 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\opmzchy3\s_code[1].js Tue Dec 20 03:27:20 2005 => System found infected with whenu.savenow Spyware/Adware (s_code[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:21 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\opmzchy3\misc[1].js Tue Dec 20 03:27:21 2005 => System found infected with whenu.savenow Spyware/Adware (misc[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:21 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\g6r41u7n\ads[1].htm Tue Dec 20 03:27:21 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:21 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\g6r41u7n\formie[1].css Tue Dec 20 03:27:21 2005 => System found infected with whenu.savenow Spyware/Adware (formie[1].css)! Action taken: No Action Taken. Tue Dec 20 03:27:21 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\g6r41u7n\ads[2].htm Tue Dec 20 03:27:21 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:22 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\s71jambd\ads[1].htm Tue Dec 20 03:27:22 2005 => System found infected with whenu.savenow Spyware/Adware (ads[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:23 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\uxgbqjgf\ads[2].htm Tue Dec 20 03:27:23 2005 => System found infected with whenu.savenow Spyware/Adware (ads[2].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:24 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\pagu3h1k\s_code[1].js Tue Dec 20 03:27:24 2005 => System found infected with whenu.savenow Spyware/Adware (s_code[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:25 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\dx5zaury\blank[1].htm Tue Dec 20 03:27:25 2005 => System found infected with whenu.savenow Spyware/Adware (blank[1].htm)! Action taken: No Action Taken. Tue Dec 20 03:27:25 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\dx5zaury\show_ads[2].js Tue Dec 20 03:27:25 2005 => System found infected with whenu.savenow Spyware/Adware (show_ads[2].js)! Action taken: No Action Taken. Tue Dec 20 03:27:26 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\dx5zaury\global[1].js Tue Dec 20 03:27:26 2005 => System found infected with redv Spyware/Adware (global[1].js)! Action taken: No Action Taken. Tue Dec 20 03:27:26 2005 => Offending file found: C:\WINDOWS\Local Settings\Temporary Internet Files\content.ie5\dx5zaury\s_code[1].js Tue Dec 20 03:27:26 2005 => System found infected with whenu.savenow Spyware/Adware (s_code[1].js)! Action taken: No Action Taken.

Here are the directions for MWav:

Please download the free MWAV antivirus tool from here. Save it to the desktop and run it. Follow the prompts to scan your system for viruses. Then please post for me the log of infected files from the BOTTOM panel of the scan window. Please remove any lines relating to "Invalid object" as they are not needed at this time.

I'm still having the full page ads come up.

sorry double posted

clueless, I apologize for the long delay in getting back to you. Life and a bit of laziness got in the way. Do you still need help?

YES!!! I still need help

Ok, can I see a new HJT log, please?

Hello. DAParker has asked for some help due to his 'real life' work schedule, so I'll do my best to get your case completed. I'll need a short time today to review the thread up to this point and then will post back with my initial conclusions and recommendations., Thanks for your patience. daveai

Okay…I'm back.

I went through this thread twice, ans also read through the previous winfixer problem.

Please send me the screenshot of the full page ad. Send it to daveai AT tomcoyote DOT org…turn that into a real email address with the @ and the . inserted at the appropriate places. (We post them that way to prevent the spam harvesters from adding our email addresses to thier lists).

Also, since you are on win-98…I cannot ask you to run my favorite scans So, we may have to run several things to figure out what in still infecting your system.

Please start by running the Kaspersky online scan. It won't clean anything…but it takes a fairly deep look into your system.

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Thanks
daveai

KASPERSKY ON-LINE SCANNER REPORT Thursday, January 26, 2006 22:24:47 Operating System: Microsoft Windows 98 SE Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 27/01/2006 Kaspersky Anti-Virus database records: 173323 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: a:\ c:\ m:\ Scan Statistics: Total number of scanned objects: 34089 Number of viruses found: 6 Number of infected objects: 12 Number of suspicious objects: 0 Duration of the scan process: 8207 sec Infected Object Name - Virus Name c:\WINDOWS\SYSTEM\UpdInstall.exe.tcf Infected: not-a-virus:AdWare.Win32.Look2Me.b c:\WINDOWS\Application Data\Identities\{9A3F3FE0-DA33-11D3-9E83-E5051EB6D217}\Microsoft\Outlook Express\Sent Items.dbx/[From "Libby Simmons" <[removed]>][Date Mon, 19 Dec 2005 13:50:29 -0500]/UNNAMED/msg118.dll Infected: not-a-virus:AdWare.Win32.Look2Me.an c:\WINDOWS\Application Data\Identities\{9A3F3FE0-DA33-11D3-9E83-E5051EB6D217}\Microsoft\Outlook Express\Sent Items.dbx/[From "Libby Simmons" <[removed]>][Date Mon, 19 Dec 2005 13:50:29 -0500]/UNNAMED Infected: not-a-virus:AdWare.Win32.Look2Me.an c:\WINDOWS\Application Data\Identities\{9A3F3FE0-DA33-11D3-9E83-E5051EB6D217}\Microsoft\Outlook Express\Sent Items.dbx Infected: not-a-virus:AdWare.Win32.Look2Me.an c:\WINDOWS\Desktop\gettbar.exe/WISE0081.BIN Infected: not-a-virus:AdWare.Win32.Dogpile.a c:\WINDOWS\Desktop\gettbar.exe Infected: not-a-virus:AdWare.Win32.Dogpile.a c:\WINDOWS\Downloaded Program Files\CONFLICT.1\Toolbar_cobrand.EXE/WISE0077.BIN Infected: not-a-virus:AdWare.Win32.Dogpile.a c:\WINDOWS\Downloaded Program Files\CONFLICT.1\Toolbar_cobrand.EXE Infected: not-a-virus:AdWare.Win32.Dogpile.a c:\WINDOWS\Downloaded Program Files\popcaploader.dll.tcf Infected: not-a-virus:Downloader.Win32.PopCap.b c:\WINDOWS\Downloaded Program Files\UWFX5_0001_N53L1025NetInstaller.exe Infected: not-a-virus:Downloader.Win32.Agent.f c:\temp\CSv20P160.exe Infected: Backdoor.Win32.Ruledor.j c:\!KillBox\msg118.dll Infected: not-a-virus:AdWare.Win32.Look2Me.an Scan process completed.

Thanks

I looked at the screen shot…it helped me understand what's going on. Thanks

Okay…let's start cleaning out some of those files. This process may take several 'go-roounds'.

First we'll use Killbox. Go ahead and re-download this tool, just in case there is a later version that the one you acquired earlier.

Then…save these instructions to a text file (Notepad) on your desktop so you can find them in safe mode.


1) Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

2) Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.

3) Once in Safe Mode, please run Killbox.

4) Select "Delete on Reboot".

5) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:


c:\WINDOWS\SYSTEM\UpdInstall.exe.tcf
c:\WINDOWS\Desktop\gettbar.exe
c:\WINDOWS\Downloaded Program Files\CONFLICT.1\Toolbar_cobrand.EXE
c:\WINDOWS\Downloaded Program Files\popcaploader.dll.tcf
c:\WINDOWS\Downloaded Program Files\UWFX5_0001_N53L1025NetInstaller.exe
c:\temp\CSv20P160.exe


6) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

7) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

Let the system reboot.


Then, open Outlook Express, and in the 'Sent Items' folder please locate and delete all messages that fit this description:

From "Libby Simmons" <[removed]>][Date Mon, 19 Dec 2005 13:50:29 -0500]



Next, clean out all the temporary files and cookies on your system. Go to Start > Run and enter: cleanmgr. Let it scan your system for files to remove. Check these three boxes and then press ok to remove: Temporary Files, Temporary Internet Files, Recycle Bin.

Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and when the scan is finished, choose Edit > select all -> File > delete.

Please let me know about any problems with the temp file deletes.

Note: If you cannot delete them all at once because you have too many, then click and hold ctrl and highlight a batch of them at a time. Once highlighted, R-click over the highlight and select delete. Rinse, lather, repeat until folder is empty


Finally, rerun the Kaspersky scan and send the results.

Thanks
daveai

There was two files I could not find. They were: C:\windows\dowloaded program files\conflict\toolbar_cobrand.exe And c:\windows\downloaded program files\uwx5_0001_n53l1025netinstaller.exe. There were also two files I could not delete when I was deleting the temp files. They are ~df93f9.tmp And ~df438.tmp ——————————————————————————- KASPERSKY ON-LINE SCANNER REPORT Friday, January 27, 2006 17:30:09 Operating System: Microsoft Windows 98 SE Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 27/01/2006 Kaspersky Anti-Virus database records: 173495 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: a:\ c:\ m:\ Scan Statistics: Total number of scanned objects: 33231 Number of viruses found: 6 Number of infected objects: 9 Number of suspicious objects: 0 Duration of the scan process: 7299 sec Infected Object Name - Virus Name c:\WINDOWS\SYSTEM\UpdInstall.exe.tcf Infected: not-a-virus:AdWare.Win32.Look2Me.b c:\WINDOWS\Desktop\gettbar.exe/WISE0081.BIN Infected: not-a-virus:AdWare.Win32.Dogpile.a c:\WINDOWS\Desktop\gettbar.exe Infected: not-a-virus:AdWare.Win32.Dogpile.a c:\WINDOWS\Downloaded Program Files\CONFLICT.1\Toolbar_cobrand.EXE/WISE0077.BIN Infected: not-a-virus:AdWare.Win32.Dogpile.a c:\WINDOWS\Downloaded Program Files\CONFLICT.1\Toolbar_cobrand.EXE Infected: not-a-virus:AdWare.Win32.Dogpile.a c:\WINDOWS\Downloaded Program Files\popcaploader.dll.tcf Infected: not-a-virus:Downloader.Win32.PopCap.b c:\WINDOWS\Downloaded Program Files\UWFX5_0001_N53L1025NetInstaller.exe Infected: not-a-virus:Downloader.Win32.Agent.f c:\!KillBox\msg118.dll Infected: not-a-virus:AdWare.Win32.Look2Me.an c:\!KillBox\CSv20P160.exe Infected: Backdoor.Win32.Ruledor.j Scan process completed.