"mfcdoc.exe" eating up hard drive

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\ACSD.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
c:\program files\cox\applications\app\CurtainsSysSvcNt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\HELP\KB\mfcdoc.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\WINDOWS\SYSTEM32\USRshutA.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\ERICAD~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.cox.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - D:\iMesh\iMesh5\iMeshBHO.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: CATLEvents Object - {13589181-4F0D-4553-B9F8-B4B72172C139} - C:\DOCUME~1\ERICAD~1\LOCALS~1\Temp\codcfm.dat
O2 - BHO: - {2233C8A2-78D8-471B-97BF-74B6B40B88EA} - C:\WINDOWS\lbbho.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD75B9D5FA7D} - (no file)
O2 - BHO: AuthBHO.cBHO - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - C:\Program Files\Cox\Applications\app\AuthBHO.dll
O2 - BHO: - {D49DF576-4E3A-440F-AEFE-85B04C659E6E} - C:\WINDOWS\lbbho.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Cox Popup Blocker - {64634180-B0EA-48B6-82B7-9620D33362C1} - C:\Program Files\Cox\Applications\app\AuthBHO.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [*javaexp] C:\WINDOWS\msagent\javaexp.exe
O4 - HKLM\..\Run: [AuthConsoleStart] C:\Program Files\Cox\Applications\app\cox.exe
O4 - HKLM\..\Run: [*keymain] C:\WINDOWS\Cursors\keymain.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\HP\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [*mfcdoc] C:\WINDOWS\HELP\KB\mfcdoc.exe
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKCU\..\Run: [uoltray] C:\Program Files\Juno\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\JUSearch\hcm.exe" -w
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: WebConnect Pro 5.1.7 - https://s1web4.cnh.com/WebConnectDU.cab
O16 - DPF: Win32 Classes -
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1127018879244
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4047/ftp…23/cpbrkpie.cab
O20 - Winlogon Notify: aps - C:\DOCUME~1\ERICAD~1\LOCALS~1\Temp\spa.dat
O20 - Winlogon Notify: bakvga - C:\DOCUME~1\Emily\LOCALS~1\Temp\agvkab.dat
O20 - Winlogon Notify: javaabr - C:\DOCUME~1\ERICAD~1\LOCALS~1\Temp\rbaavaj.dat
O20 - Winlogon Notify: mfcdoc - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\ACSD.EXE
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Curtains for Windows System Service (CurtainsSysSvc) - Authentium, Inc. - c:\program files\cox\applications\app\CurtainsSysSvcNt.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

doirone,

Welcome to the forum, sorry about the delay but we have been overwhelmed with logs. Let me tell ya, you have a real mess going on. Your infected with the Vundo Trojan and also all kinds of spyware. What I would like you to do if you have not resolved this issue is to move HJT to its own folder and post a new
complete log as your system may have changed since your original post.

DO THIS FIRST
Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.

Easy to fix,
* just go to MY COMPUTER > YOUR C:\ DRIVE and create a new folder and name it HIJACKTHIS .
* Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
* Now open the new folder you just created and right click within that folder and select PASTE .
* Now HJT should reside in C:\HIJACKTHIS\HIJACKTHIS.EXE


Now open HJT Scan and Save a Log File, the file will open in Notepad, go to Edit > Select All, Edit > Copy and paste the entire log into this thread.

Ken

Sorry for taking so long! ewido anti-malware - Scan report ——————————————————— + Created on: 9:59:50 PM, 2/21/2006 + Report-Checksum: 79BAA668 + Scan result: HKLM\SOFTWARE\Classes\ATLEvents.ATLEvents -> Adware.VirtuMonde : Error during cleaning HKLM\SOFTWARE\Classes\ATLEvents.ATLEvents.1 -> Adware.VirtuMonde : Error during cleaning HKLM\SOFTWARE\Classes\CLSID\{13589181-4F0D-4553-B9F8-B4B72172C139} -> Adware.Vundo : Cleaned with backup HKLM\SOFTWARE\Classes\Common.Buttons -> Adware.WebSearch : Cleaned with backup HKLM\SOFTWARE\Classes\MediaAccX.Installer -> Adware.WinAd : Cleaned with backup HKLM\SOFTWARE\Classes\MediaAccX.Installer\CLSID -> Adware.WinAd : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{13589181-4F0D-4553-B9F8-B4B72172C139} -> Adware.Vundo : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\AUI -> Adware.WebSearch : Cleaned with backup HKU\S-1-5-21-682003330-492894223-1957994488-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{13589181-4F0D-4553-B9F8-B4B72172C139} -> Adware.Vundo : Cleaned with backup C:\WINDOWS\lbbho.dll -> Adware.Neon : Cleaned with backup C:\WINDOWS\HELP\TOUR\AUDIO\javarun.exe -> Adware.Virtumonde : Cleaned with backup C:\WINDOWS\HELP\KB\__delete_on_reboot__mfcdoc.exe -> Adware.Virtumonde : Cleaned with backup C:\WINDOWS\SYSTEM32\SHAgentNew.dll -> Adware.BargainBuddy : Cleaned with backup C:\WINDOWS\SYSTEM32\70tovmto.ini -> Adware.Sahat : Cleaned with backup C:\WINDOWS\SYSTEM32\BO2802040113.dll -> Adware.BargainBuddy : Cleaned with backup C:\WINDOWS\WEB\Wallpaper\binpc.exe -> Adware.Virtumonde : Cleaned with backup C:\WINDOWS\iLookup -> Adware.eZula : Cleaned with backup C:\WINDOWS\NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup C:\WINDOWS\AppPatch\mcms.exe -> Adware.Virtumonde : Cleaned with backup C:\WINDOWS\msbbi.exe -> Trojan.Imiserv.c : Cleaned with backup C:\WINDOWS\clipg.exe -> Trojan.Imiserv.c : Cleaned with backup C:\WINDOWS\addins\rasbin.exe -> Adware.Virtumonde : Cleaned with backup C:\WINDOWS\addins\ftpcat.exe -> Adware.Virtumonde : Cleaned with backup C:\WINDOWS\cpbrkpie.ocx -> Adware.Coupons : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq6.tmp -> TrackingCookie.Advertising : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq82.tmp\newdotnet6_38.dll -> Adware.NewDotNet : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq16.tmp -> TrackingCookie.Serving-sys : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq18.tmp -> TrackingCookie.Centrport : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq1A.tmp -> TrackingCookie.Com : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq1D.tmp -> TrackingCookie.Doubleclick : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq1E.tmp -> TrackingCookie.Ru4 : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq23.tmp -> TrackingCookie.Fastclick : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq24.tmp -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq2A.tmp -> TrackingCookie.Questionmarket : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq2B.tmp -> TrackingCookie.Serving-sys : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq2C.tmp -> TrackingCookie.Serving-sys : Cleaned with backup C:\Documents and Settings\All Users\Application Data\Authentium\Curtains150\Quarantine\Quarantine\ppq2D.tmp -> TrackingCookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\ksat.dat -> Adware.Virtumonde : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~904438.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~908611.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\temp.fr9351\TBPS.exe -> Adware.WebSearch : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\temp.fr9351\toolbar.dll -> Adware.WebSearch : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\temp.fr9351\PIB.exe -> Adware.WebSearch : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~777282.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~839670.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~749326.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\WTA1\WinTA.cab/WToolsA.exe -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~995409.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~907132.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~734642.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~785048.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~804643.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~565263.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~429512.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~434218.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~864540.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~878007.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~821569.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~440631.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~741382.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~633104.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~895065.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~554762.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~850853.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~784325.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~704718.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~896609.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~754587.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~728857.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~892651.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~462391.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~380166.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~774541.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~465734.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~737371.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~335284.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~828829.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~877354.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~868808.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~603649.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~926014.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\Cookies\erica doiron@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\Cookies\erica doiron@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~600382.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~35131.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~981631.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~847735.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~856422.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~702856.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~978075.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~746913.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~790739.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~896500.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~781805.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~811365.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~708390.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~918463.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~493791.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~515091.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~770348.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~954270.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~713534.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~707401.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~946946.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~797885.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~284549.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~705590.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~767185.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~775717.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~922009.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~694726.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~720981.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~608672.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~627777.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~765999.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~674343.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~891800.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~722076.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~752955.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\pctitna.dat -> Adware.Virtumonde : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~430846.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\bewvrs.dat -> Adware.Virtumonde : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\~435414.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\kabsar.dat -> Adware.Virtumonde : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\payek.dat -> Adware.Virtumonde : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\tacofni.dat -> Adware.Virtumonde : Cleaned with backup C:\Documents and Settings\Erica Doiron\Local Settings\Temp\ctts.exe -> Logger.VBStat.a : Cleaned with backup C:\Documents and Settings\Erica Doiron\Cookies\erica [removed][1].txt -> TrackingCookie.Reliablestats : Cleaned with backup C:\Documents and Settings\Emily\Local Settings\Temp\~566395.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Emily\Local Settings\Temp\~548548.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Emily\Local Settings\Temp\~513068.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Emily\Local Settings\Temp\~895023.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Emily\Local Settings\Temp\~593361.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Emily\Local Settings\Temp\~710343.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Emily\Local Settings\Temporary Internet Files\Content.IE5\PH012JO6\popcaploader_v6[1].cab/PopCapLoader.dll -> Not-A-Virus.Downloader.Win32.PopCap.b : Cleaned with backup C:\Documents and Settings\Emily\Local Settings\Temporary Internet Files\Content.IE5\QBI3G1UR\WAS5Scan[1].exe -> Not-A-Virus.Downloader.Win32.Agent.d : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Advertising : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@atdmt[3].txt -> TrackingCookie.Atdmt : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Adserver : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@com[2].txt -> TrackingCookie.Com : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@bfast[2].txt -> TrackingCookie.Bfast : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@webstat[1].txt -> TrackingCookie.Web-stat : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@xxxcounter[1].txt -> TrackingCookie.Xxxcounter : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Sexcounter : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Addynamix : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@sexlist[1].txt -> TrackingCookie.Sexlist : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@2o7[3].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@coxhsi.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Emily\Cookies\emily@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned with backup C:\Documents and Settings\Emily\Cookies\[removed][3].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Rich\Local Settings\Temp\~765718.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Rich\Local Settings\Temp\~33446.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Rich\Local Settings\Temp\~600692.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Rich\Local Settings\Temp\~930505.tmp -> Adware.Wintol : Cleaned with backup C:\Documents and Settings\Rich\Cookies\rich@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup C:\Documents and Settings\Rich\Cookies\rich@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup C:\Documents and Settings\Rich\Cookies\rich@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Rich\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Rich\Cookies\rich@coxhsi.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Rich\Cookies\rich@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup C:\Documents and Settings\Rich\Cookies\rich@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup C:\Documents and Settings\Rich\Cookies\rich@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup C:\Documents and Settings\Rich\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Program Files\FileSubmit\Pirates of The Caribbean Active\nnez_388.exe -> Adware.NewDotNet : Cleaned with backup ::Report End

Vundo fix VundoFix V4.2.26 Scan started at 7:50:28 PM 2/21/2006 Listing files found while scanning…. C:\DOCUME~1\Emily\LOCALS~1\Temp\codcfm.dat C:\WINDOWS\HELP\KB\codcfm.bak1 C:\WINDOWS\HELP\KB\codcfm.bak2 C:\WINDOWS\HELP\KB\codcfm.tmp C:\WINDOWS\HELP\KB\codcfm.ini C:\WINDOWS\JAVA\aluesa.bak1 C:\WINDOWS\JAVA\aluesa.tmp C:\WINDOWS\JAVA\aluesa.ini C:\WINDOWS\FONTS\agvofni.bak1 C:\WINDOWS\FONTS\agvofni.ini C:\WINDOWS\AppPatch\gers.bak1 C:\WINDOWS\AppPatch\gers.bak2 C:\WINDOWS\AppPatch\gers.ini C:\WINDOWS\$NtServicePackUninstall$\gers.bak1 C:\WINDOWS\$NtServicePackUninstall$\gers.ini C:\WINDOWS\Driver Cache\rbaavaj.ini2 C:\WINDOWS\Driver Cache\rbaavaj.tmp C:\WINDOWS\Driver Cache\rbaavaj.ini C:\WINDOWS\Driver Cache\rbaavaj.ini2 C:\WINDOWS\ServicePackFiles\spa.ini2 C:\WINDOWS\ServicePackFiles\spa.tmp C:\WINDOWS\ServicePackFiles\spa.ini2 Attempting to delete C:\DOCUME~1\Emily\LOCALS~1\Temp\codcfm.dat C:\DOCUME~1\Emily\LOCALS~1\Temp\codcfm.dat Could not be deleted. Attempting to delete C:\WINDOWS\HELP\KB\codcfm.bak1 C:\WINDOWS\HELP\KB\codcfm.bak1 Has been deleted! Attempting to delete C:\WINDOWS\HELP\KB\codcfm.bak2 C:\WINDOWS\HELP\KB\codcfm.bak2 Has been deleted! Attempting to delete C:\WINDOWS\HELP\KB\codcfm.tmp C:\WINDOWS\HELP\KB\codcfm.tmp Has been deleted! Attempting to delete C:\WINDOWS\HELP\KB\codcfm.ini C:\WINDOWS\HELP\KB\codcfm.ini Has been deleted! Attempting to delete C:\WINDOWS\JAVA\aluesa.bak1 C:\WINDOWS\JAVA\aluesa.bak1 Has been deleted! Attempting to delete C:\WINDOWS\JAVA\aluesa.tmp C:\WINDOWS\JAVA\aluesa.tmp Has been deleted! Attempting to delete C:\WINDOWS\JAVA\aluesa.ini C:\WINDOWS\JAVA\aluesa.ini Has been deleted! Attempting to delete C:\WINDOWS\FONTS\agvofni.bak1 C:\WINDOWS\FONTS\agvofni.bak1 Has been deleted! Attempting to delete C:\WINDOWS\FONTS\agvofni.ini C:\WINDOWS\FONTS\agvofni.ini Has been deleted! Attempting to delete C:\WINDOWS\AppPatch\gers.bak1 C:\WINDOWS\AppPatch\gers.bak1 Has been deleted! Attempting to delete C:\WINDOWS\AppPatch\gers.bak2 C:\WINDOWS\AppPatch\gers.bak2 Has been deleted! Attempting to delete C:\WINDOWS\AppPatch\gers.ini C:\WINDOWS\AppPatch\gers.ini Has been deleted! Attempting to delete C:\WINDOWS\$NtServicePackUninstall$\gers.bak1 C:\WINDOWS\$NtServicePackUninstall$\gers.bak1 Has been deleted! Attempting to delete C:\WINDOWS\$NtServicePackUninstall$\gers.ini C:\WINDOWS\$NtServicePackUninstall$\gers.ini Has been deleted! Attempting to delete C:\WINDOWS\Driver Cache\rbaavaj.ini2 C:\WINDOWS\Driver Cache\rbaavaj.ini2 Has been deleted! Attempting to delete C:\WINDOWS\Driver Cache\rbaavaj.tmp C:\WINDOWS\Driver Cache\rbaavaj.tmp Has been deleted! Attempting to delete C:\WINDOWS\Driver Cache\rbaavaj.ini C:\WINDOWS\Driver Cache\rbaavaj.ini Has been deleted! Attempting to delete C:\WINDOWS\ServicePackFiles\spa.ini2 C:\WINDOWS\ServicePackFiles\spa.ini2 Has been deleted! Attempting to delete C:\WINDOWS\ServicePackFiles\spa.tmp C:\WINDOWS\ServicePackFiles\spa.tmp Has been deleted! Performing Repairs to the registry. Done!

doirone,

Log is looking better but still a few more things to do.

Open HJT Scan Only, close your browser and all open windows, check these entries and click on Fix Checked.


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: (no name) - {D49DF576-4E3A-440F-AEFE-85B04C659E6E} - (no file)
O20 - Winlogon Notify: aps - C:\DOCUME~1\ERICAD~1\LOCALS~1\Temp\spa.dat
O20 - Winlogon Notify: javaabr - C:\DOCUME~1\ERICAD~1\LOCALS~1\Temp\rbaavaj.dat
O20 - Winlogon Notify: mfcdoc - C:\DOCUME~1\Emily\LOCALS~1\Temp\codcfm.dat


Make sure you still have windows enabled to show all files and folders and boot into Safemode.

We are going to manually clean out your temp files.

Go to My Computer > C:\windows\temp Open the temp folder and delete everything in the folder but not the temp folder itself.


Go to C:\windows\prefetch and clean out everyting in the prefetch folder but not the prefetch folder itself.


Go C:\ documents and setting and for every user of the computer, go to Local Settings > Temp and clean out the temp folder , but not the temp folder itself

Go to C:\ documents and setting > Temporary Internet files and delete everything in that folder but not the folder itself.



Empty your recycle bin



Reboot normally and post a new HJT log please.

Ken

I did everything, but there were some items that would not delete from the temp files. Here they are: mon155.log ~DF9CAE.tmp ~DF541D.tmp rbaavaj.dat codcfm.dat I will reboot and post a new HJT log.

doirone,

If you look at your latest HJT log you will see 3 020 entries, they are leftover from the Vundo Infection and cant understand why they wont go, especially running from a temp folder. I am looking into this to see if any of the people I work with have run into it. In the meantime, I would like you to run the 14 day Trial of Spysweeper and see what it comes up with. After you run it, post back with the Spysweeper Report and a new HJT log please.


Download the trial version of Spy Sweeper from Here

Scroll to the bottom of the page and be sure to download and install the Free 4.5 Trial and not t the free online scan.

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive
alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C.
Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Restart your computer, and then please copy and paste the SpySweeper log into this thread.

******** 10:28 PM: | Start of Session, Saturday, February 25, 2006 | 10:28 PM: Spy Sweeper started 10:28 PM: Sweep initiated using definitions version 621 10:28 PM: Starting Memory Sweep 10:31 PM: Found Adware: virtumonde 10:31 PM: Detected running threat: C:\Documents and Settings\Erica Doiron\Local Settings\Temp\spa.dat (ID = 82999) 10:31 PM: Detected running threat: C:\Documents and Settings\Erica Doiron\Local Settings\Temp\rbaavaj.dat (ID = 82999) 10:31 PM: Detected running threat: C:\Documents and Settings\Emily\Local Settings\Temp\codcfm.dat (ID = 82999) 10:38 PM: Memory Sweep Complete, Elapsed Time: 00:10:15 10:38 PM: Starting Registry Sweep 10:38 PM: Found Trojan Horse: 2nd-thought 10:38 PM: HKCR\interface\{49db48ff-02b5-4645-b676-94a4df1aa026}\ (7 subtraces) (ID = 101981) 10:38 PM: HKLM\software\classes\interface\{49db48ff-02b5-4645-b676-94a4df1aa026}\ (7 subtraces) (ID = 101996) 10:39 PM: Found Adware: comet cursor 10:39 PM: HKCR\appid\dmserver.exe\ (ID = 106303) 10:39 PM: HKLM\software\classes\appid\dmserver.exe\ (ID = 106525) 10:39 PM: Found Adware: coolsavings 10:39 PM: HKCR\clsid\{11bdb904-c0bc-41ce-910b-0d12fd619fd0}\ (2 subtraces) (ID = 106999) 10:39 PM: HKLM\software\classes\clsid\{11bdb904-c0bc-41ce-910b-0d12fd619fd0}\ (2 subtraces) (ID = 107005) 10:39 PM: HKCR\atlevents.atlevents.1\ (3 subtraces) (ID = 145627) 10:39 PM: HKCR\atlevents.atlevents\ (5 subtraces) (ID = 145628) 10:39 PM: HKLM\software\classes\atlevents.atlevents.1\ (3 subtraces) (ID = 145646) 10:39 PM: HKLM\software\classes\atlevents.atlevents.1\clsid\ (1 subtraces) (ID = 145647) 10:39 PM: HKLM\software\classes\atlevents.atlevents\ (5 subtraces) (ID = 145648) 10:39 PM: Found Adware: websearch toolbar 10:39 PM: HKLM\system\currentcontrolset\enum\root\legacy_wintoolssvc\ (7 subtraces) (ID = 146518) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\microsoft\cryptography\userkeys\cometkey\ (4 subtraces) (ID = 106729) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\microsoft\internet explorer\toolbar\webbrowser\ || {fe6bc4ef-5676-484b-88ae-883323913256} (ID = 106731) 10:39 PM: Found Adware: ieplugin hijacker 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\microsoft\internet explorer\main\ || search page (ID = 128215) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\microsoft\internet explorer\searchurl\ (ID = 128220) 10:39 PM: Found Adware: 180search assistant/zango 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\180solutions\ (10 subtraces) (ID = 135617) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\btiein\ (4 subtraces) (ID = 146368) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\microsoft\internet explorer\toolbar\webbrowser\ || {339bb23f-a864-48c0-a59f-29ea915965ec} (ID = 146464) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\microsoft\internet explorer\urlsearchhooks\ || {8952a998-1e7e-4716-b23d-3dbe03910972} (ID = 146466) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\toolbar\ (20 subtraces) (ID = 146513) 10:39 PM: Found Adware: websearch.com hijacker 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\microsoft\internet explorer\main\ || search bar (ID = 146561) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\microsoft\internet explorer\toolbar\webbrowser\ || {339bb23f-a864-48c0-a59f-29ea915965ec} (ID = 392934) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-500\software\toolbar\ (20 subtraces) (ID = 646239) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\microsoft\internet explorer\toolbar\webbrowser\ || {fe6bc4ef-5676-484b-88ae-883323913256} (ID = 106731) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\microsoft\internet explorer\main\ || search page (ID = 128215) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\microsoft\internet explorer\searchurl\ (ID = 128220) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\180solutions\ (10 subtraces) (ID = 135617) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\btiein\ (4 subtraces) (ID = 146368) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\microsoft\internet explorer\toolbar\webbrowser\ || {339bb23f-a864-48c0-a59f-29ea915965ec} (ID = 146464) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\microsoft\internet explorer\urlsearchhooks\ || {87766247-311c-43b4-8499-3d5fec94a183} (ID = 146467) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\toolbar\ (20 subtraces) (ID = 146513) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\wintools\ (18 subtraces) (ID = 146514) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\microsoft\internet explorer\main\ || search bar (ID = 146561) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\microsoft\internet explorer\toolbar\webbrowser\ || {339bb23f-a864-48c0-a59f-29ea915965ec} (ID = 392934) 10:39 PM: Found Adware: sidesearch 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\toolbar\ (20 subtraces) (ID = 646239) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1006\software\wintools\ (18 subtraces) (ID = 646241) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\microsoft\internet explorer\main\ || search page (ID = 128215) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\microsoft\internet explorer\searchurl\ (ID = 128220) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\180solutions\ (10 subtraces) (ID = 135617) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\btiein\ (4 subtraces) (ID = 146368) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\microsoft\internet explorer\toolbar\webbrowser\ || {339bb23f-a864-48c0-a59f-29ea915965ec} (ID = 146464) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\microsoft\internet explorer\urlsearchhooks\ || {87766247-311c-43b4-8499-3d5fec94a183} (ID = 146467) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\microsoft\internet explorer\main\ || search bar (ID = 146561) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\microsoft\internet explorer\toolbar\webbrowser\ || {339bb23f-a864-48c0-a59f-29ea915965ec} (ID = 392934) 10:39 PM: Found Adware: winantispyware 2005 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\winsoftware\winfixer 2005\ (6 subtraces) (ID = 528169) 10:39 PM: HKU\WRSS_Profile_S-1-5-21-682003330-492894223-1957994488-1005\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423) 10:39 PM: HKU\S-1-5-21-682003330-492894223-1957994488-1004\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423) 10:39 PM: HKU\S-1-5-20\software\microsoft\internet explorer\toolbar\webbrowser\ || {fe6bc4ef-5676-484b-88ae-883323913256} (ID = 106731) 10:40 PM: HKU\S-1-5-19\software\microsoft\internet explorer\toolbar\webbrowser\ || {fe6bc4ef-5676-484b-88ae-883323913256} (ID = 106731) 10:40 PM: HKU\S-1-5-18\software\microsoft\internet explorer\toolbar\webbrowser\ || {fe6bc4ef-5676-484b-88ae-883323913256} (ID = 106731) 10:40 PM: Registry Sweep Complete, Elapsed Time:00:01:22 10:40 PM: Starting Cookie Sweep 10:40 PM: Found Spy Cookie: 203.199.200 cookie 10:40 PM: emily@203.199.200[1].txt (ID = 1941) 10:40 PM: Found Spy Cookie: rightmedia cookie 10:40 PM: emily@rightmedia[2].txt (ID = 3259) 10:40 PM: Found Spy Cookie: tripod cookie 10:40 PM: emily@tripod[1].txt (ID = 3591) 10:40 PM: Found Spy Cookie: classmates cookie 10:40 PM: emily@classmates[2].txt (ID = 2384) 10:40 PM: Found Spy Cookie: go.com cookie 10:40 PM: emily@go[2].txt (ID = 2728) 10:40 PM: [removed][1].txt (ID = 2729) 10:40 PM: Found Spy Cookie: nextag cookie 10:40 PM: emily@nextag[2].txt (ID = 5014) 10:40 PM: Found Spy Cookie: apmebf cookie 10:40 PM: emily@apmebf[2].txt (ID = 2229) 10:40 PM: Found Spy Cookie: bravenet cookie 10:40 PM: emily@bravenet[1].txt (ID = 2322) 10:40 PM: Found Spy Cookie: atwola cookie 10:40 PM: emily@atwola[1].txt (ID = 2255) 10:40 PM: Found Spy Cookie: realmedia cookie 10:40 PM: emily@realmedia[1].txt (ID = 3235) 10:40 PM: Found Spy Cookie: gostats cookie 10:40 PM: [removed][2].txt (ID = 2748) 10:40 PM: Found Spy Cookie: ask cookie 10:40 PM: emily@ask[1].txt (ID = 2245) 10:40 PM: Found Spy Cookie: websponsors cookie 10:40 PM: [removed][1].txt (ID = 3665) 10:40 PM: Found Spy Cookie: 2o7.net cookie 10:40 PM: erica doiron@2o7[1].txt (ID = 1957) 10:40 PM: erica doiron@go[1].txt (ID = 2728) 10:40 PM: Found Spy Cookie: tacoda cookie 10:40 PM: erica doiron@tacoda[1].txt (ID = 6444) 10:40 PM: Found Spy Cookie: revenue.net cookie 10:40 PM: erica doiron@revenue[1].txt (ID = 3257) 10:40 PM: Found Spy Cookie: bluestreak cookie 10:40 PM: erica doiron@bluestreak[2].txt (ID = 2314) 10:40 PM: Found Spy Cookie: ru4 cookie 10:40 PM: erica doiron@edge.ru4[1].txt (ID = 3269) 10:40 PM: Found Spy Cookie: questionmarket cookie 10:40 PM: erica doiron@questionmarket[1].txt (ID = 3217) 10:40 PM: Found Spy Cookie: zedo cookie 10:40 PM: erica doiron@zedo[1].txt (ID = 3762) 10:40 PM: erica [removed][1].txt (ID = 2729) 10:40 PM: erica [removed][1].txt (ID = 2729) 10:40 PM: erica [removed][1].txt (ID = 2729) 10:40 PM: Found Spy Cookie: casalemedia cookie 10:40 PM: erica doiron@casalemedia[2].txt (ID = 2354) 10:40 PM: Found Spy Cookie: statcounter cookie 10:40 PM: erica doiron@statcounter[2].txt (ID = 3447) 10:40 PM: Found Spy Cookie: pointroll cookie 10:40 PM: erica [removed][1].txt (ID = 3148) 10:40 PM: erica doiron@realmedia[1].txt (ID = 3235) 10:40 PM: Found Spy Cookie: tribalfusion cookie 10:40 PM: erica doiron@tribalfusion[2].txt (ID = 3589) 10:40 PM: erica [removed][1].txt (ID = 3763) 10:40 PM: erica [removed][1].txt (ID = 2729) 10:40 PM: Found Spy Cookie: overture cookie 10:40 PM: erica [removed][1].txt (ID = 3106) 10:40 PM: Found Spy Cookie: specificclick.com cookie 10:40 PM: erica [removed][2].txt (ID = 3400) 10:40 PM: erica [removed][1].txt (ID = 3106) 10:40 PM: Found Spy Cookie: server.iad.liveperson cookie 10:40 PM: erica [removed][1].txt (ID = 3341) 10:40 PM: Cookie Sweep Complete, Elapsed Time: 00:00:03 10:40 PM: Starting File Sweep 10:40 PM: Warning: Failed to open file "c:\hiberfil.sys". Access is denied 10:40 PM: Warning: Failed to open file "c:\pagefile.sys". Access is denied 10:44 PM: Found Adware: shopathomeselect 10:44 PM: gah95on6.ini (ID = 75741) 10:44 PM: bln02nqv.ini (ID = 75683) 10:44 PM: tm97pj39.dat (ID = 75644) 10:44 PM: kdlmjh8r.dat (ID = 75676) 10:44 PM: p1fumi62.dat (ID = 75851) 10:45 PM: Found Adware: marketscore 10:45 PM: osmim.dll (ID = 69218) 10:45 PM: osconfig.dll (ID = 69214) 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\system.log". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\software.log". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\default.log". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\security". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\sam". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\sam.log". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\security.log". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\system". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\software". The process cannot access the file because it is being used by another process 10:46 PM: Warning: Failed to open file "c:\windows\system32\config\default". The process cannot access the file because it is being used by another process 10:48 PM: c:\windows\system32\sahimages (2 subtraces) (ID = -2147480329) 10:58 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat.log". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat.log". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7b74085d-f8af-4db4-90ab-e297eec38924.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa6bfbdb2-88b5-416e-b213-2c490481681b.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs874ad761-9666-4c52-9ea8-da5518095a00.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4a6cae33-de43-4659-8f48-ff75f1b5dca6.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3cc90b7d-da50-4db2-9e3e-afa25f6853a1.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa3be49ae-ecb8-4da4-bf41-a4532fd5e4eb.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7796bbd7-dcf2-429b-965d-1b6cbfbedb9d.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb86d987a-f98d-47be-a8e5-af2325bcc186.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8dd9fc12-17f4-4e7f-b332-9297fc3b7c5f.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9602ad1d-a6fd-4d56-b73d-b311fe3887ba.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs57bfea26-0bac-4b6b-822f-4ce2cc90ee9f.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs59c6be33-8aa8-4b51-a198-6e0a963da4e7.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs620463ac-d4d9-4dbd-a018-9782694cc29b.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs17c28df9-b9bc-4517-9c9b-d4e740e45345.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs097b9257-8498-4ef3-9c1a-cbad106913b6.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa9bf0b25-3683-45d3-b36e-202442bc3a01.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs27f6895f-c82b-4103-874b-c73e9cfdc797.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs41310712-cd14-449b-aa56-8c8eefde1124.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4d8346ea-328a-4c6a-8013-a08727157000.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs296c936e-d5c1-4a46-a87a-059168f21b7d.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb6b7f47a-6295-4e54-b388-85f29d98fd3e.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6d2ae2f6-5f89-427d-a763-e4d701f97d47.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfc6ede99-dab4-41a3-a707-e454f338bb00.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs29acb236-1f57-497c-9384-3f30661101b4.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd4e4e5ac-6f1a-4745-bbe5-350d0cb51cf3.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc545e225-6f88-4328-9003-0629bd319115.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5f8ff1f8-28b9-4999-b817-2d071111c22d.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse28bdae6-fedc-4da7-821f-663b6feaef02.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsaaafb484-d35b-4019-9a3d-d6afa1f007b7.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsde3f98a8-574d-487e-8299-9568daaae2e4.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9fd8dc7c-b05d-4ec4-a4a2-d5ad6c475abe.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1e4cc709-da28-40f2-ba95-32dccad71844.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse69b96d2-af57-4af0-aca7-d1f49c238001.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs65db2e7e-ae9d-425b-a57e-28fbbbdb7a21.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs32f89a52-4255-477f-9657-c7ffab710142.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs81fea47a-1870-4aab-9589-a199eaac311b.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs99853691-c847-442e-bde8-b55b64413198.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsca7b1d8e-4cc7-4dd4-b2bc-ddaa5f91594d.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsefaa6e0d-b4da-4d72-8162-11640e47ca4d.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb147ebaa-14d2-401e-9a22-320a1da6b6a4.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse2aa6e8d-d58c-4fff-89ca-385b8225e370.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3318e6eb-53d0-4886-b512-beb71df0b591.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs44bbf439-9be7-449e-b247-d6a805f3675a.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfef193c4-0cb6-4126-855c-ae7dbbf0a33a.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs33b4de5d-aeab-4982-ba3d-0734692aceb6.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs64e89774-3175-42d5-9813-c69d0670c090.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0d42c8a6-95e1-496e-a004-f90fe1223065.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsdc360f08-0e75-42b6-9593-070ac63d1468.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0dc762b9-0be9-4edf-abe2-9f1d6ddf6cca.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs11394361-2399-41c2-b9e7-d70c7063acd0.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd409a797-f359-4ffd-8cf4-82961f8572d9.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3a66ae52-7c26-42ca-823f-b8ed511e2696.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd5995cde-8bf2-41cf-b120-5d76e856e427.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6d473591-ffca-48c0-a166-6fe0ef594ebf.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb7dff5db-bf2b-46ac-8fe8-f45243e7e576.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9eb16097-73a5-4daf-9634-f8f4a0c4f044.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsaa6cf6c5-feee-46a3-a83d-b79cd85eec56.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1029c6d0-f31c-4fac-8c7b-05ef22570ba6.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse405518e-7002-4334-ad57-e1449ff32bf8.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs264509c9-8f02-4e49-9204-1aa5a120f5e0.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd25bcac8-92b9-464c-aa1d-8f1817c3be43.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6812092a-fdd6-431d-a957-50a562d71d7a.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs74025741-1ac3-4f16-a2b8-ce1bb32d5b68.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs24aed460-a566-4e34-aa85-be2ecee42ca7.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs92a4e839-d0a9-4c15-8d35-5dde205de87c.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4a291920-5a0c-4ac2-84ac-14ae3b1a58ae.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscb0da389-63c9-46af-af79-893ab7ae43c4.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs395698c9-572e-433f-bae7-6e7162e27db4.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbc9caab9-9680-45e6-aae9-5c4acb9b7b97.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3be09fff-90f4-44d7-9d1e-a2f1ce0bd819.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbc290a5e-e1da-4aec-a7b6-72261d40f19d.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa177c5c6-b7b3-4320-811a-e02f4783d825.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3ea06fc6-3bd4-4f30-9849-212b09ed55c3.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs04df0851-7ed8-47d3-b508-d87e72ab3d15.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8560eb32-59b3-40b3-8c01-b6532175888d.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse18bcf87-a00e-420e-8bb4-8fd2dc517a46.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbe6cc071-6f20-4c83-b9c0-d4ebd61fe6de.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs672d08f3-dd80-4c5a-9f34-c07293a11764.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbe849697-eaca-4c80-85e0-430e6d8594fa.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscseff20b6c-75c7-46bc-9a10-1446acf09afb.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbd6e2f51-b671-49b5-93d1-12e60025d3af.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa03dc424-016d-4e75-8ea0-ea6bbe12889d.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3dd5a021-b0a4-44c8-a347-09d07553affe.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6c240b12-bcb6-4939-9d6c-de59490877c5.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs179d7ad9-5178-43b1-8dfc-9766290432c8.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd40091ef-8e41-4fb7-8988-11457a1a7c73.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs58c89077-d1c2-4a7e-afb5-bf622e6296c5.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsdaf4cd45-02b8-4464-b9b0-308998878c28.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsdd140871-e9e9-412c-b16c-7271de6a512c.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1acba0eb-7f5d-46d2-a2e5-5f602936f9f5.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs801d1e6c-6266-4c71-8f2c-114faecabd1e.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa2f912d2-b1c9-4ef5-829c-f4cd502d6bc9.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs33b4e159-3b30-4a56-9b09-ae8d085075f4.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfabbd664-f950-4deb-b41e-75eef35bd103.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsce63a541-bee9-4515-9827-2a5dd8e93a6e.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs88929789-1774-4b6d-b73a-5cc712d4bc3f.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs725ea08a-f819-46ec-84f0-526c282acaa3.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse323c835-928d-4f35-8f17-714aa2db8d26.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7cf03ce8-e21f-4f88-860c-8f6d02ae9742.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs099fbf12-c192-4393-ad34-584ccf1e0283.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc3e5f52c-026b-4460-87fb-9a28d2478f37.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs598ed113-4cb3-4ec2-a21d-2f48cbbfeb21.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8ebdcafe-7c8a-4d51-9451-abaac48802d3.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbee7a0bd-1748-40bd-9087-f2e566b2783a.tmp". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\erica doiron\ntuser.dat". The process cannot access the file because it is being used by another process 10:58 PM: Warning: Failed to open file "c:\documents and settings\erica doiron\ntuser.dat.log". The process cannot access the file because it is being used by another process 10:58 PM: sysbac.dat (ID = 82999) 10:58 PM: ssvofni.dat (ID = 82999) 10:58 PM: cvslitu.dat (ID = 82999) 10:58 PM: niamavaj.dat (ID = 82999) 10:58 PM: gersmw.dat (ID = 82999) 10:58 PM: bewbil.dat (ID = 82999) 10:58 PM: ksidgepj.dat (ID = 82999) 10:58 PM: ipatyalp.dat (ID = 82999) 10:58 PM: nuyek.dat (ID = 82999) 10:58 PM: tunnur.dat (ID = 82999) 10:58 PM: syssar.dat (ID = 82999) 10:58 PM: codcfm.dat (ID = 82999) 10:58 PM: itnaipat.dat (ID = 82999) 10:58 PM: bksys.dat (ID = 82999) 10:58 PM: dvdmoc.dat (ID = 82999) 10:58 PM: avajgmi.dat (ID = 82999) 10:58 PM: aluesa.dat (ID = 82999) 10:58 PM: ws.dat (ID = 82999) 10:58 PM: dmcksat.dat (ID = 82999) 10:58 PM: pxesm.dat (ID = 82999) 10:58 PM: pxemoc.dat (ID = 82999) 10:58 PM: ofninib.dat (ID = 82999) 10:58 PM: gepjbv.dat (ID = 82999) 10:58 PM: nurbil.dat (ID = 82999) 10:58 PM: nurmoc.dat (ID = 82999) 10:58 PM: 3pmipat.dat (ID = 82999) 10:58 PM: tenicp.dat (ID = 82999) 10:58 PM: mocptf.dat (ID = 82999) 10:58 PM: sodsp.dat (ID = 82999) 10:58 PM: ofnitac.dat (ID = 82999) 10:58 PM: nibsmw.dat (ID = 82999) 10:58 PM: nudvd.dat (ID = 82999) 11:00 PM: Warning: Failed to open file "c:\documents and settings\erica doiron\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 11:00 PM: Warning: Failed to open file "c:\documents and settings\erica doiron\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 11:01 PM: pitnof.dat (ID = 82999) 11:01 PM: spa.dat (ID = 82999) 11:01 PM: piyek.dat (ID = 82999) 11:01 PM: rbaavaj.dat (ID = 82999) 11:01 PM: sodsp.dat (ID = 82999) 11:01 PM: ksidgepj.dat (ID = 82999) 11:01 PM: spa.dat (ID = 82999) 11:01 PM: gersmw.dat (ID = 82999) 11:01 PM: bksys.dat (ID = 82999) 11:01 PM: ws.dat (ID = 82999) 11:01 PM: elorba.dat (ID = 82999) 11:01 PM: rbaavaj.dat (ID = 82999) 11:01 PM: codcfm.dat (ID = 82999) 11:01 PM: 3pmipat.dat (ID = 82999) 11:01 PM: piyek.dat (ID = 82999) 11:01 PM: Found Adware: netpal 11:01 PM: gamehouse games.url (ID = 70891) 11:01 PM: big fish games.url (ID = 70885) 11:01 PM: flyordie games.url (ID = 70890) 11:02 PM: c:\program files\common files\winsoftware (1 subtraces) (ID = -2147476682) 11:02 PM: pcheck.dll (ID = 119204) 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:12 PM: Warning: Invalid Stream 11:13 PM: Warning: Unhandled Archive Type 11:13 PM: Warning: Invalid Stream 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:14 PM: Warning: Invalid file - not a PKZip file 11:20 PM: File Sweep Complete, Elapsed Time: 00:39:59 11:20 PM: Full Sweep has completed. Elapsed time 00:51:50 11:20 PM: Traces Found: 364 11:23 PM: Removal process initiated 11:24 PM: Quarantining All Traces: 180search assistant/zango 11:24 PM: Quarantining All Traces: 2nd-thought 11:24 PM: Quarantining All Traces: virtumonde 11:25 PM: virtumonde is in use. It will be removed on reboot. 11:25 PM: spa.dat is in use. It will be removed on reboot. 11:25 PM: rbaavaj.dat is in use. It will be removed on reboot. 11:25 PM: codcfm.dat is in use. It will be removed on reboot. 11:25 PM: C:\Documents and Settings\Erica Doiron\Local Settings\Temp\spa.dat is in use. It will be removed on reboot. 11:25 PM: C:\Documents and Settings\Erica Doiron\Local Settings\Temp\rbaavaj.dat is in use. It will be removed on reboot. 11:25 PM: C:\Documents and Settings\Emily\Local Settings\Temp\codcfm.dat is in use. It will be removed on reboot. 11:25 PM: Quarantining All Traces: websearch toolbar 11:25 PM: Quarantining All Traces: comet cursor 11:25 PM: Quarantining All Traces: marketscore 11:25 PM: Quarantining All Traces: sidesearch 11:25 PM: Quarantining All Traces: coolsavings 11:25 PM: Quarantining All Traces: ieplugin hijacker 11:25 PM: Quarantining All Traces: netpal 11:25 PM: Quarantining All Traces: shopathomeselect 11:25 PM: Quarantining All Traces: websearch.com hijacker 11:25 PM: Quarantining All Traces: 203.199.200 cookie 11:25 PM: Quarantining All Traces: 2o7.net cookie 11:25 PM: Quarantining All Traces: apmebf cookie 11:25 PM: Quarantining All Traces: ask cookie 11:25 PM: Quarantining All Traces: atwola cookie 11:25 PM: Quarantining All Traces: bluestreak cookie 11:25 PM: Quarantining All Traces: bravenet cookie 11:25 PM: Quarantining All Traces: casalemedia cookie 11:25 PM: Quarantining All Traces: classmates cookie 11:25 PM: Quarantining All Traces: go.com cookie 11:25 PM: Quarantining All Traces: gostats cookie 11:25 PM: Quarantining All Traces: nextag cookie 11:25 PM: Quarantining All Traces: overture cookie 11:25 PM: Quarantining All Traces: pointroll cookie 11:25 PM: Quarantining All Traces: questionmarket cookie 11:25 PM: Quarantining All Traces: realmedia cookie 11:25 PM: Quarantining All Traces: revenue.net cookie 11:25 PM: Quarantining All Traces: rightmedia cookie 11:25 PM: Quarantining All Traces: ru4 cookie 11:25 PM: Quarantining All Traces: server.iad.liveperson cookie 11:25 PM: Quarantining All Traces: specificclick.com cookie 11:25 PM: Quarantining All Traces: statcounter cookie 11:25 PM: Quarantining All Traces: tacoda cookie 11:25 PM: Quarantining All Traces: tribalfusion cookie 11:25 PM: Quarantining All Traces: tripod cookie 11:25 PM: Quarantining All Traces: websponsors cookie 11:25 PM: Quarantining All Traces: winantispyware 2005 11:25 PM: Quarantining All Traces: zedo cookie 11:26 PM: Preparing to restart your computer. Please wait… 11:26 PM: Removal process completed. Elapsed time 00:02:40 ******** 10:26 PM: | Start of Session, Saturday, February 25, 2006 | 10:26 PM: Spy Sweeper started 10:27 PM: Your spyware definitions have been updated. 10:28 PM: | End of Session, Saturday, February 25, 2006 |

I need a new HJT log to see if those entries are gone. Ken