spyware and virus problems

Go to add/remove programs and remove Webhancer if present.


Scan with hijackthis and put a check besdie these lines and choose FIX

O4 - HKLM\..\RunServices: [ÿ_zskX`PVIT] C:\WINDOWS\System32\_zskwrkni05\JMPRWISO\TIVP`X.exe

O16 - DPF: {5E63815E-340D-47C2-BF56-E337F46CE57B} - http://update.nprotect.net/sci/install/NPKCWebInstall.cab

O20 - AppInit_DLLs: sysiusrc.dll hhsedpvo.dll
O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll
O20 - Winlogon Notify: polymorphreg - C:\Documents and Settings\All Users\Documents\Settings\polymorph.dll
O20 - Winlogon Notify: scrovfpo - C:\WINDOWS\System32\scrovfpo.dll

O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwolyf.exe

Next

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post as well as a bew hijackthis log please.

Download http://swandog46.geekstogo.com/avenger.zip by Swandog46, and save it to your Desktop. Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.
Check the 'Input script manually' box.
Click on the magnifying glass icon.
Copy everything in the code box below (don't copy the word "CODE in the box header, just the box contents starting at Files to delete) and paste it in the box that opens:

WARNING: This script is not a general fix. If you are not this user, running this script could damage your system

Files to delete:
C:\t.inx
C:\WINDOWS\Downloaded Program Files\USDR6_0001_D08M0404NetInstaller.exe 
C:\WINDOWS\hosts.sam 
C:\WINDOWS\ieredir.exe 
C:\WINDOWS\media_motor_bundle.exe
C:\WINDOWS\preredir.exe 
C:\WINDOWS\system32\icon_mediamotor.exe
C:\WINDOWS\system32\mscgdc.dll 
C:\WINDOWS\system32\scrovfpo.exe 
C:\WINDOWS\Tagasuarus2.exe
C:\WINDOWS\YazzleBundle-1119.exe 
C:\WINDOWS\YOINSI.exe

Folders to delete:
C:\WINDOWS\media_motor_bundle.exe
C:\WINDOWS\system32\ts_mediamotor.exe
C:\WINDOWS\Tagasuarus2.exe
C:\WINDOWS\YazzleBundle-1119.exe
C:\WINDOWS\YOINSI.exe

Now click the 'Done' button.
Click on the traffic light icon and OK the prompt.
You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it manually.

Please post a new HijackThis log and the log file from Avenger at C:\avenger.txt

New kapersky log please. I will be out of town for a few days and wont be abke to look at it until my return.

C:\avenger\backup.zip/avenger/hosts.sam Infected: Trojan.Win32.Qhost.hl skipped C:\avenger\backup.zip/avenger/icon_mediamotor.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\avenger\backup.zip/avenger/icon_mediamotor.exe/stream Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\avenger\backup.zip/avenger/icon_mediamotor.exe Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\avenger\backup.zip/avenger/ieredir.exe Infected: Trojan-Spy.Win32.Sters.ae skipped C:\avenger\backup.zip/avenger/media_motor_bundle.exe/data0002/stream/data0002 Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\avenger\backup.zip/avenger/media_motor_bundle.exe/data0002/stream Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\avenger\backup.zip/avenger/media_motor_bundle.exe/data0002 Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\avenger\backup.zip/avenger/media_motor_bundle.exe/data0003/stream/data0001 Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\avenger\backup.zip/avenger/media_motor_bundle.exe/data0003/stream Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\avenger\backup.zip/avenger/media_motor_bundle.exe/data0003 Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\avenger\backup.zip/avenger/media_motor_bundle.exe Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\avenger\backup.zip/avenger/mscgdc.dll Infected: not-a-virus:AdWare.Win32.WebSearch.bb skipped C:\avenger\backup.zip/avenger/preredir.exe Infected: Trojan-Downloader.Win32.VB.ahx skipped C:\avenger\backup.zip/avenger/scrovfpo.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\avenger\backup.zip/avenger/t.inx Infected: Trojan-Downloader.Win32.Tibs.fj skipped C:\avenger\backup.zip/avenger/Tagasuarus2.exe/data0002 Infected: Trojan-Downloader.Win32.VB.tw skipped C:\avenger\backup.zip/avenger/Tagasuarus2.exe/data0003 Infected: Trojan.Win32.VB.tg skipped C:\avenger\backup.zip/avenger/Tagasuarus2.exe/data0007 Infected: Trojan-Downloader.Win32.VB.tw skipped C:\avenger\backup.zip/avenger/Tagasuarus2.exe Infected: Trojan-Downloader.Win32.VB.tw skipped C:\avenger\backup.zip/avenger/USDR6_0001_D08M0404NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped C:\avenger\backup.zip/avenger/YazzleBundle-1119.exe/data0002 Infected: Trojan.Win32.Scapur.k skipped C:\avenger\backup.zip/avenger/YazzleBundle-1119.exe Infected: Trojan.Win32.Scapur.k skipped C:\avenger\backup.zip/avenger/YOINSI.exe/data0002 Infected: Trojan.Win32.Scapur.k skipped C:\avenger\backup.zip/avenger/YOINSI.exe Infected: Trojan.Win32.Scapur.k skipped C:\avenger\backup.zip ZIP: infected - 25 skipped C:\Documents and Settings\Michael Lee\Local Settings\Temporary Internet Files\Content.IE5\S1QZSHYN\sploit[1].anr Infected: Trojan-Downloader.Win32.Ani.c skipped C:\Program Files\mIRC\backup\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179511.exe Infected: Trojan-Clicker.Win32.VB.lb skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179519.exe Infected: Trojan-Downloader.Win32.Qoologic.at skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179520.exe Infected: Trojan-Downloader.Win32.Qoologic.at skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179521.exe Infected: Trojan-Downloader.Win32.VB.tw skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179522.exe Infected: Trojan-Downloader.Win32.VB.tw skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179523.exe Infected: Trojan-Downloader.Win32.VB.aga skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179524.dll Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179526.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179541.exe Infected: Trojan-Clicker.Win32.VB.lb skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179616.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179618.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179625.dll Infected: not-a-virus:AdWare.Win32.TrafficSol.a skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179648.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179652.exe/InpB/Ssk.exe Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179652.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179652.exe CAB: infected - 2 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179654.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179744.exe Infected: Trojan-Downloader.Win32.PurityScan.co skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179745.exe Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179746.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.l skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179747.DLL Infected: not-a-virus:AdWare.Win32.MyWebSearch.o skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179754.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179755.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP402\A0179756.exe Infected: Trojan.Win32.Runner.j skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP403\A0179805.DLL Infected: not-a-virus:AdWare.Win32.MySearch.e skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP403\A0179849.exe/EXE-file/data0002 Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP403\A0179849.exe/EXE-file Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP403\A0179849.exe Embedded EXE: infected - 2 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP403\A0179854.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.g skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP403\A0179864.dll Infected: not-a-virus:AdWare.Win32.MySearch.e skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP403\A0179868.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0179955.exe Infected: Trojan-Downloader.Win32.Qoologic.c skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0179956.dll Infected: Trojan-Downloader.Win32.Agent.agw skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0179957.dll Infected: Trojan-Downloader.Win32.Qoologic.bj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0179965.exe Infected: Trojan-Proxy.Win32.Lager.aq skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0179967.exe Infected: Trojan-Downloader.Win32.Small.cwo skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180004.dll Infected: Trojan-Proxy.Win32.Agent.df skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180007.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180008.dll Infected: Backdoor.Win32.Agent.ady skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180009.exe Infected: Backdoor.Win32.Agent.ady skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180010.dll Infected: Backdoor.Win32.Agent.ady skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180011.exe Infected: Backdoor.Win32.Agent.ady skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180026.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180071.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180075.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180084.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180090.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP404\A0180094.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP405\A0180130.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP405\A0180134.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP405\A0181133.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP405\A0182140.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP405\A0183140.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP405\A0184150.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP405\A0184156.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP405\A0184173.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185173.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185206.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185212.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185218.exe Infected: Trojan-Downloader.Win32.Tibs.fj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185220.exe Infected: Trojan-Proxy.Win32.Lager.aq skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185227.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185235.exe Infected: Trojan-Downloader.Win32.Agent.alr skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185237.exe Infected: Trojan-Downloader.Win32.Tibs.fj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185238.exe Infected: Trojan-Downloader.Win32.Tibs.fj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185239.exe Infected: Trojan.Win32.Dialer.pw skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185240.dll Infected: Trojan-PSW.Win32.Sinowal.af skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185241.dll Infected: Trojan-PSW.Win32.Sinowal.ae skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185247.dll Infected: Backdoor.Win32.Agent.adr skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185248.exe Infected: Trojan-Proxy.Win32.Xorpix.u skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185249.exe Infected: Trojan-Downloader.Win32.Small.cxx skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185250.exe Infected: Trojan-Downloader.Win32.Small.ctk skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185252.exe Infected: Trojan-Downloader.Win32.Small.cyb skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185253.exe Infected: Trojan-Downloader.Win32.Small.cyb skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185254.exe Infected: Trojan-Downloader.Win32.VB.wz skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185255.dll Infected: Trojan-Downloader.Win32.Banload.ayv skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185256.exe Infected: Trojan-Proxy.Win32.Lager.aq skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185258.exe Infected: Trojan-Proxy.Win32.Lager.aq skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185259.exe Infected: Trojan-Downloader.Win32.VB.aga skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185260.exe Infected: Trojan-Downloader.Win32.Small.cqy skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185261.exe Infected: Trojan-Spy.Win32.Sters.ac skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185262.exe Infected: Trojan-Dropper.Win32.Agent.lu skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185263.exe Infected: Trojan-Downloader.Win32.Small.cwo skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185264.exe Infected: Trojan-Spy.Win32.VB.eh skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185265.dll Infected: Trojan-Proxy.Win32.Agent.km skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185266.exe Infected: Trojan-Proxy.Win32.Agent.km skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185267.exe Infected: Trojan-Downloader.Win32.VB.tw skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185268.exe Infected: Trojan-Downloader.Win32.Agent.ala skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185270.exe/data0002 Infected: not-a-virus:AdWare.Win32.HotSearchBar.d skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185270.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185271.dll Infected: not-a-virus:AdWare.Win32.HotSearchBar.d skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185272.exe Infected: not-a-virus:AdWare.Win32.MediaMotor.o skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185276.exe/ClientAX.dll Infected: not-a-virus:AdWare.Win32.180Solutions.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185276.exe CAB: infected - 1 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185277.dll Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185278.dll Infected: not-a-virus:AdWare.Win32.EZula.cc skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185279.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185280.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.g skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185281.exe Infected: not-a-virus:AdWare.Win32.Agent.ag skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185283.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185294.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP406\A0185295.dll Infected: Trojan-Downloader.Win32.Qoologic.bj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185359.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185372.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185385.exe Infected: Trojan-Downloader.Win32.Small.skn skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185388.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185396.exe Infected: Trojan-Proxy.Win32.Agent.ji skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185403.dll Infected: Trojan-Downloader.Win32.Qoologic.bj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185404.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185421.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185433.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185442.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185450.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185460.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185466.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185467.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP407\A0185469.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP408\A0185476.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP408\A0185531.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP408\A0185563.exe Infected: Trojan-Downloader.Win32.Small.dgk skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP409\A0185582.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP409\A0185594.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP409\A0185602.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP409\A0185623.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185691.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185717.sam Infected: Trojan.Win32.Qhost.hl skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185718.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185718.exe/stream Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185718.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185719.exe Infected: Trojan-Spy.Win32.Sters.ae skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185720.exe/data0002/stream/data0002 Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185720.exe/data0002/stream Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185720.exe/data0002 Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185720.exe/data0003/stream/data0001 Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185720.exe/data0003/stream Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185720.exe/data0003 Infected: not-a-virus:AdWare.Win32.BHO.ao skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185720.exe NSIS: infected - 6 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185721.dll Infected: not-a-virus:AdWare.Win32.WebSearch.bb skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185722.exe Infected: Trojan-Downloader.Win32.VB.ahx skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185723.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185724.exe/data0002 Infected: Trojan-Downloader.Win32.VB.tw skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185724.exe/data0003 Infected: Trojan.Win32.VB.tg skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185724.exe/data0007 Infected: Trojan-Downloader.Win32.VB.tw skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185724.exe NSIS: infected - 3 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185725.exe/data0002 Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185725.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185726.exe/data0002 Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185726.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185738.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\System Volume Information\_restore{E33BAC5C-4441-4260-B6AD-477142D2EEA7}\RP410\A0185746.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\WINDOWS\system32\scrovfpo.exe Infected: Trojan-Downloader.Win32.Small.dgj skipped C:\WINDOWS\system32\ts_mediamotor.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\WINDOWS\system32\ts_mediamotor.exe/stream Infected: not-a-virus:AdWare.Win32.SideFind.a skipped C:\WINDOWS\system32\ts_mediamotor.exe NSIS: infected - 2 skipped Scan process completed.

New hijackthis log please as it has been a few days.

Please download Look2Me-Destroyer.exe to your desktop.

• Close all windows before continuing.
  
• Double-click Look2Me-Destroyer.exe to run it.
  
• Put a check next to Run this program as a task .
  
• You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
  
• When Look2Me-Destroyer re-opens, click the Scan for L2M button , your desktop icons will disappear, this is normal.
  
• Once it's done scanning, click the Remove L2M button .
  
• You will receive a Done Scanning message, click OK .
  
• When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK .
  
• Your computer will then shutdown.
  
• Turn your computer back on.
  
  
  If you receive a message from your firewall about this program accessing the internet please allow it.
  
  If you receive a runtime error '339'. please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32. Directory
  http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
  
  NEXT
  
  Scan with hijackthis and put a heck beside these lines and choose FIX
  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
  
  R3 - Default URLSearchHook is missing
  
  O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
  
  O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
  
  O4 - HKLM\..\Run: [ad8rIU3s] C:\WINDOWS\System32\cvn0.exe
  O4 - HKLM\..\Run: [k6mmN5IOU] "C:\WINDOWS\System32\wfxqhv.exe"
  O4 - HKLM\..\Run: [axqff3f3] RUNDLL32.EXE w21e21e3.dll,n 001ff3f20000000321e21e3
  O4 - HKLM\..\Run: [w21e5528.dll] RUNDLL32.EXE w21e5528.dll,I2 001ff3f2021e5528
  O4 - HKLM\..\RunServices: [ÿ_zskX`PVIT] C:\WINDOWS\System32\_zskwrkni05\JMPRWISO\TIVP`X.exe
  O4 - HKCU\..\Run: [Olss] "C:\DOCUME~1\MICHAE~1\APPLIC~1\PPATCH~1\wucrtupd.exe" -vt yazr
  O4 - HKCU\..\Run: [CAS2] "C:\Program Files\System Files\System.exe"
  O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
  O4 - HKCU\..\Run: [Fxlkti] C:\Documents and Settings\Michael Lee\Application Data\S?mantec\??plorer.exe
  O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\mwinlpez.exe
  O4 - Startup: Z_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
  
  O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
  
  O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\System32\xeymi.dll
  
  O20 - AppInit_DLLs: winlogon.dll sysiusrc.dll hhsedpvo.dll
  O20 - Winlogon Notify: policies - C:\WINDOWS\system32\ir84l5lq1.dll
  O20 - Winlogon Notify: scrovfpo - C:\WINDOWS\System32\scrovfpo.dll
  
  O21 - SSODL: CDRecorder006 - {A3BC5E20-0235-1ABF-9CE1-00AA00512006} - C:\WINDOWS\System32\aqva32.dll (file missing)
  
  Reboot to safe mode and delete these files/fodlers if present
  
  C:\WINDOWS\System32\cvn0.exe C:\WINDOWS\System32\wfxqhv.exe C:\WINDOWS\System32\_zskwrkni05 C:\Program Files\System Files\System.exe C:\Program Files\TClock C:\WINDOWS\system32\mwinlpez.exe C:\WINDOWS\system32\dwdsregt.exe
  
  
  
  Download http://swandog46.geekstogo.com/avenger.zip by Swandog46, and save it to your Desktop. Extract avenger.exe from the Zip file and save it to your desktop
  
  Run avenger.exe by double-clicking on it.
  Check the 'Input script manually' box.
  Click on the magnifying glass icon.
  Copy everything in the code box below (don't copy the word "CODE in the box header, just the box contents starting at Files to delete) and paste it in the box that opens:
  
  WARNING: This script is not a general fix. If you are not this user, running this script could damage your system
  
  
  
  

  Files to delete:
  C:\WINDOWS\system32\ts_mediamotor.exe/stream/data0002 
  C:\WINDOWS\system32\ts_mediamotor.exe/stream
  C:\WINDOWS\system32\ts_mediamotor.exe

  
  
  
  Now click the 'Done' button.
  Click on the traffic light icon and OK the prompt.
  You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it manually.
  
  
  
• Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log and the file from Avenger at C:\avenger.txt

Download http://swandog46.geekstogo.com/avenger.zip by Swandog46, and save it to your Desktop. Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.
Check the 'Input script manually' box.
Click on the magnifying glass icon.
Copy everything in the code box below (don't copy the word "CODE in the box header, just the box contents starting at Files to delete) and paste it in the box that opens:

WARNING: This script is not a general fix. If you are not this user, running this script could damage your system

Files to delete:
C:\WINDOWS\System32\scrovfpo.dll

Now click the 'Done' button.
Click on the traffic light icon and OK the prompt.
You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it manually.

Please post a new HijackThis log and the log file from Avenger at C:\avenger.txt

Please download Asquared from the link below.

http://www.emsisoft.com/en/software/download/

Safe it to your desktop. Next open and check for updates.

Boot to safe mode (tap f8 while bios loads)

Then scan your system (this will take some time) after the scan is compelte allow it to fix what it has found. If there is something that it can not clean please let me know what it was.

Then reboot and post a new hijackthis log.