My Browser's being hijacked !

Please download Look2Me-Destroyer.exe to your desktop.

• Close all windows before continuing.
  
• Double-click Look2Me-Destroyer.exe to run it.
  
• Put a check next to Run this program as a task .
  
• You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
  
• When Look2Me-Destroyer re-opens, click the Scan for L2M button , your desktop icons will disappear, this is normal.
  
• Once it's done scanning, click the Remove L2M button .
  
• You will receive a Done Scanning message, click OK .
  
• When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK .
  
• Your computer will then shutdown.
  
• Turn your computer back on.
  
• Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.

If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339'. please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32. Directory
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

Step # 1

Please download and run CWShredder. Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

http://www.majorgeeks.com/downloadget.php?…7fd6b3ff02edc90

REBOOT

Step #2

Please download and run Spybot 1.4 & AdAware SE Then follow the instructions in the link below to run.

Spybot & Adaware Tutorial

REBOOT

Step # 3

Then do a virus scan here >>> Trend Micro

Step # 4

First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

• Once you have downloaded ewido anti-spyware, locate the icon on the desktop
  and double-click it to launch the set up program.
• Once the setup is complete you will need run ewido and update the definition
  files.
• On the main screen select the icon "Update" then select the "
  Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of
  the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then
  select "Quarantine".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting
  your computer and continually tapping the F8 key until a menu appears.
  
  Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or
  programs while ewido is scanning, it may interfere with the scanning proccess:
• Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it to a text file on your system (make sure to remember where
  you saved that file, this is important).
• Close ewido and reboot your system back into Normal Mode and post the
  results of the ewido report scan and a new hijackthis log please.

I feel we may be making progress, but I don’t believe I am completely rid of this vile bug yet. I have done what you instructed and then some. The logs you requested are below, but please bear with me while I share some of the strange things I have observed through the process that may (or may not) be germane to this hunt. There are five family members on this home computer, each with their own user account. One of the first things I checked when all the craziness started was my Firewall settings. To my surprise, I found that it was turned off and could not be turned on because “my network administrator was using Group Policy to control it”. I got this same message no matter who I logged in as, including when I logged on as Administrator in Safe Mode. Since this is a home system, there is no “network” administrator. This was the first thing that tipped me off to the fact that my computer was being controlled by someone (or something) else. Interestingly, after all we have done so far, I am still not able to gain control over my firewall settings. Another curious thing has shown up when I’m running an Ad-Aware scan. I noticed that when it came to scanning thru the various user’s areas, it would display my name, then my wife’s, then my one daughter’s, but when it came to my second daughter, in place of her name I saw, “Local Service” followed by “Owner”, and then it went on to my son’s area. This same thing happened when I logged on as all the other users except for my second daughter. Only when I logged on as her, did her name show up in the scan order, but even then, this was followed by a brief appearance of “Local Service” and “Owner” before continuing on to my son. Does my computer think it’s owned by someone else and did that someone possibly come in thru my second daughter’s account? When I ran CWShredder, I found and removed CWS.Aff.Toolband. I ran Ad-Aware and Spybot and found nothing. However, I was unable to run the TrendMicro virus scan because my system kept hanging up during the download, and then I got a warning message from my 2Wire Gateway (i.e. DSL modem/router) that a device on my network, DJT9KY11, (which turns out to be the computer I’m working on) was suddenly sucking up an inordinate amount of bandwidth, likely due to a “blaster worm”. I got this same message when I tried to access the Internet with my laptop. I stopped trying to download and simply ran my Norton antivirus and did find and eliminate one infected file. I then downloaded and ran ewido and found, as the log shows, several Trojans, Downloaders, and Hijackers. These were quarantined and I immediately stopped getting the bandwidth message on both my desktop and my laptop. This ewido log is below and is titled “Pre Norton Fix”. Just out of curiosity, I also ran ewido when logged on as my second daughter and a few Trojan.Pakes and Downloaders. I saved this log and can send it if you like. And while I was at it, I also ran it logged on as Administrator and found another Trojan. I would run it for the other three users on this computer, but each one of these scans takes over an hour. But then I started to wonder about the integrity of my Norton program. I had also noticed that for a while now that when I began a scan, my Norton had shown messages saying that certain components (I believe 3031,6; 3031,9; and 3031,10) were missing, so I uninstalled and reinstalled Norton, did a full system scan, and found 7 Trojan.KillAV viruses. An example file name was A0430561.exe. All were in the C:\System Volume Information\restore… area. Had my previous ability to detect these with Norton been compromised? After eliminating these Trojans, I went back into Safe Mode and reran ewido again. The log for this is titled “Post Norton Fix”. The last log is the most recent HijackThis. Thanks for your help so far and PLEASE keep helping!!! Dennis Pre-Norton Fix ewido log ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 1:12:04 PM 7/20/2006 + Scan result: C:\Program Files\INSTAFINK -> Adware.404Search : Cleaned with backup (quarantined). C:\Program Files\INSTAFINK\Cache -> Adware.404Search : Cleaned with backup (quarantined). C:\Program Files\INSTAFINK\Cache\ErrorLog.txt -> Adware.404Search : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426508.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426511.EXE -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426514.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426518.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Altnet -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\ceva_emu.cvd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\cevakrnl.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\cevakrnl.ivd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\cevakrnl.rvd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\cevakrnl.xmd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\cran.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\cran.cvd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\cran.ivd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\emalware.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\emalware.cvd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\emalware.ivd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\java.cvd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\mdx_97.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\mdx_97.ivd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\na.xmd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\plugins.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\plugins.cab.cab (incomplete) -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\rup.cvd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\sdx.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\sdx.ivd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\unpack.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\unpack.cvd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\unpack.ivd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\update.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\update.txt.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet\My Altnet Shares\Bullguard Protection\ve.cvd.cab -> Adware.Altnet : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379648.DLL -> Adware.Altnet : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379987.exe -> Adware.Altnet : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380069.dll -> Adware.Altnet : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380070.dll -> Adware.Altnet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP934\A0420909.dll -> Adware.Altnet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430159.dll -> Adware.Altnet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430160.dll -> Adware.Altnet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430161.dll -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Altnet -> Adware.Altnet : Error during cleaning. HKLM\SOFTWARE\Altnet\Dashboard -> Adware.Altnet : Error during cleaning. HKLM\SOFTWARE\Altnet\Dashboard\Messages -> Adware.Altnet : Error during cleaning. HKLM\SOFTWARE\Altnet\Dashboard\Settings -> Adware.Altnet : Error during cleaning. HKLM\SOFTWARE\Altnet\TopSearch -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\CxtPls -> Adware.Apropos : Cleaned with backup (quarantined). C:\Program Files\CxtPls\AI_22-05-2005.log -> Adware.Apropos : Cleaned with backup (quarantined). C:\Program Files\CxtPls\AI_23-05-2005.log -> Adware.Apropos : Cleaned with backup (quarantined). C:\Program Files\CxtPls\AI_28-05-2005.log -> Adware.Apropos : Cleaned with backup (quarantined). C:\Program Files\CxtPls\data.bin -> Adware.Apropos : Error during cleaning. C:\RECYCLER\NPROTECT\01379633.idf/C:/Program Files/BullsEye Network/bin/adv.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379633.idf/C:/Program Files/BullsEye Network/bin/adx.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379633.idf/C:/Program Files/BullsEye Network/bin/bargains.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379633.idf/C:/WINDOWS/system32/msbe.dll -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\netut80ex.vxd/C:/WINDOWS/system32/exdl.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\netut80ex.vxd/C:/WINDOWS/system32/exul.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\netut80ex.vxd/C:/WINDOWS/system32/javexulm.vxd -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\netut80ex.vxd/C:/WINDOWS/system32/mqexdlm.srg -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP980\A0430629.dll -> Adware.CommAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP980\A0430630.exe -> Adware.CommAd : Cleaned with backup (quarantined). HKLM\SOFTWARE\dealhelper -> Adware.DealHelper : Cleaned with backup (quarantined). HKLM\SOFTWARE\dealhelper\KeyWord -> Adware.DealHelper : Cleaned with backup (quarantined). HKLM\SOFTWARE\DelFin -> Adware.Delfin : Cleaned with backup (quarantined). HKLM\SOFTWARE\DelFin\PromulGate -> Adware.Delfin : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer -> Adware.Delfin : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP963\A0425479.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaLoads Enhanced -> Adware.Downloadware : Cleaned with backup (quarantined). C:\Program Files\Common Files\jddarbjd\hbrelhaf\nptfchel.exe -> Adware.Gator : Cleaned with backup (quarantined). C:\Program Files\Common Files\jddarbjd\janenpnbjj\ertdctlpc.exe -> Adware.Gator : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426516.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426517.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426527.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426542.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426543.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426544.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426605.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426611.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426612.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP965\A0426619.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427794.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427795.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427796.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427797.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427798.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427799.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427800.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427801.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427802.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427803.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427805.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427806.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427807.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427808.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427818.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427820.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427821.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427827.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427828.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427829.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427852.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427853.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427854.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427855.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427856.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427857.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427858.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427859.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427866.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427871.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427872.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427873.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427955.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427956.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427958.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427959.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427960.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427961.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427962.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427965.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP969\A0428003.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP969\A0428004.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP969\A0428005.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP969\A0428006.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP969\A0428007.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP969\A0428008.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP969\A0428009.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP975\A0430103.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430141.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430142.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430143.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430144.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430146.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430149.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430153.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430163.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP978\A0430283.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP978\A0430284.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP978\A0430484.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP978\A0430487.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP978\A0430488.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP978\A0430489.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP978\A0430490.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430517.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430536.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430563.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430564.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430565.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430566.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430567.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430568.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430569.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430570.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430571.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430572.DLL -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430573.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430574.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430575.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430576.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430577.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430578.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380074.DLL -> Adware.MediaPops : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380075.DLL -> Adware.MediaPops : Cleaned with backup (quarantined). HKLM\SOFTWARE\WildMedia -> Adware.MidAddle : Cleaned with backup (quarantined). HKLM\SOFTWARE\WildMedia\LicenseStores -> Adware.MidAddle : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall4_80.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall4_88.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall4_94.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall5_20.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall5_40.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall5_48.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall5_64.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall6_10.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\P2P Networking -> Adware.P2PNetworking : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\P2P Networking\Cache -> Adware.P2PNetworking : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\P2P Networking\Cache\Database -> Adware.P2PNetworking : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\P2P Networking\Cache\Database\file-10001-105.sig -> Adware.P2PNetworking : Cleaned with backup (quarantined). C:\WINDOWS\SYSTEM32\P2P Networking\P2P Networking.LOG -> Adware.P2PNetworking : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380076.DLL -> Adware.PeerNet : Cleaned with backup (quarantined). C:\Program Files\PerfectNav -> Adware.PerfectNav : Cleaned with backup (quarantined). C:\Program Files\PerfectNav\BHO -> Adware.PerfectNav : Cleaned with backup (quarantined). C:\Program Files\PerfectNav\BHO\PerfectNav150.dll -> Adware.PerfectNav : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380093.dll -> Adware.RXBar : Cleaned with backup (quarantined). C:\Program Files\RXToolBar -> Adware.RXToolbar : Cleaned with backup (quarantined). C:\Program Files\RXToolBar\Cache -> Adware.RXToolbar : Cleaned with backup (quarantined). C:\Program Files\RXToolBar\Cache\CTwww_opelgtsource_com -> Adware.RXToolbar : Cleaned with backup (quarantined). C:\Program Files\RXToolBar\Cache\CTwww_playboy_com_ -> Adware.RXToolbar : Cleaned with backup (quarantined). HKU\S-1-5-21-1445258045-1907411925-173008773-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{59879FA4-4790-461C-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427832.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP979\A0430580.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\WINDOWS\Temp\~27152.tmp -> Adware.Wintol : Error during cleaning. C:\WINDOWS\Temp\~290181.tmp -> Adware.Wintol : Error during cleaning. C:\WINDOWS\Temp\~714633.tmp -> Adware.Wintol : Error during cleaning. C:\WINDOWS\Temp\~914359.tmp -> Adware.Wintol : Error during cleaning. C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427840.exe -> Backdoor.SdBot.aad : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427847.exe -> Backdoor.VB.ary : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426520.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426521.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426522.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426523.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426524.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426525.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426602.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426603.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426604.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427810.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427811.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427812.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427813.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427814.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427815.exe -> Downloader.Adload.ck : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427849.exe -> Downloader.Adload.cm : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426539.exe -> Downloader.Adload.cn : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP967\A0427750.exe -> Downloader.Adload.ct : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427831.exe -> Downloader.Adload.ct : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427861.exe -> Downloader.Adload.ct : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427896.exe -> Downloader.Adload.cu : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427897.exe -> Downloader.Adload.cu : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427898.exe -> Downloader.Adload.cu : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427845.exe -> Downloader.Adload.cv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427846.exe -> Downloader.Adload.cv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427862.exe -> Downloader.Adload.cw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427863.exe -> Downloader.Adload.cw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427864.exe -> Downloader.Adload.cw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427865.exe -> Downloader.Adload.cw : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380108.exe/g.exe -> Downloader.IstBar.is : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426535.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426536.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426608.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426609.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427822.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427823.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427869.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427870.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\9MQXG8UP\load67[1].zip -> Downloader.VB.afo : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\9MQXG8UP\load67[2].zip -> Downloader.VB.afo : Cleaned with backup (quarantined). C:\setup30.exe -> Downloader.VB.afo : Cleaned with backup (quarantined). C:\setup32.exe -> Downloader.VB.afo : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426504.exe -> Downloader.VB.afv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427844.exe -> Downloader.VB.afv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427860.exe -> Downloader.VB.afv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427848.exe -> Downloader.VB.agi : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427867.exe -> Downloader.VB.agi : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP963\A0425502.exe -> Downloader.VB.agk : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426519.exe -> Downloader.VB.agk : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426601.exe -> Downloader.VB.agk : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP965\A0426635.exe -> Downloader.VB.agk : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP965\A0426704.exe -> Downloader.VB.agk : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427851.exe -> Downloader.VB.agp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426530.exe -> Hijacker.VB.fc : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP964\A0426538.exe -> Hijacker.VB.fc : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP968\A0427850.exe -> Hijacker.VB.nh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP977\A0430147.exe -> Hijacker.VB.nh : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.Downloader.Win32.PopCap.b : Cleaned with backup (quarantined). C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP978\A0430383.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Cookies\dennis@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\dennis@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\dennis@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Local Settings\Temp\Cookies\ellen@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\[removed][2].txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Cookies\dennis@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\Sam\Local Settings\Temp\Cookies\sam@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\[removed][2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379393.TXT -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379394.TXT -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\dennis@clickbank[2].txt -> TrackingCookie.Clickbank : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\dennis@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Emily\Cookies\emily@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\system@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379043.TXT -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379044.TXT -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379045.TXT -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379378.TXT -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379379.TXT -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379380.TXT -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\dennis@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\Sam\Local Settings\Temp\Cookies\sam@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379391.TXT -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379392.TXT -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380209.TXT -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380211.TXT -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380212.TXT -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380213.TXT -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380214.TXT -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\system@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\dennis@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\[removed][2].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380899.TXT -> TrackingCookie.Goclick : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380900.TXT -> TrackingCookie.Goclick : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\dennis@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\dennis@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\dennis@overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\dennis@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\dennis@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379382.TXT -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379383.TXT -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379384.TXT -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379385.TXT -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379387.TXT -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Sam\Local Settings\Temp\Cookies\sam@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\dennis@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Cookies\dennis@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Dennis\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Emily\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Sam\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Sam\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379029.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379030.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379039.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379040.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379041.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379049.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379050.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379051.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379060.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379061.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379062.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379198.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379199.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379341.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379342.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379347.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379348.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379349.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379351.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379358.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379359.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379360.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379366.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379367.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379368.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379375.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379376.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379377.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379398.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379399.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379400.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379405.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379406.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379423.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379424.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379425.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379434.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379435.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379436.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380206.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380207.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380208.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01380215.TXT -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Ellen\Cookies\ellen@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379361.TXT -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379362.TXT -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379363.TXT -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379364.TXT -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\01379365.TXT -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\dennis@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\WINDOWS\Temp\Cookies\sam@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\Program Files\Common Files\{941261D3-0703-1033-0826-020409200001}\Update.exe -> Trojan.Starter.65 : Cleaned with backup (quarantined). ::Report end Post-Norton Fix ewido log —————————-

Lets eee if we can get the administrator clean then we can look at the other user account logs.

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download AproposFix from here:
http://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file in the aproposfix folder.

NEXT

Please download http://users.telenet.be/marcvn/tools/delcmdservice.zip (by Marckie), and save it to your Desktop.
Unzip the content to your Desktop (a folder named delcmdservice)
Double-click on the delcmdservice folder
Double-click on delreg.bat to launch the tool
When the tool has finished, please reboot your computer

After restarting, with only HijackThis running, scan and when complete, remove the following entries if still there by checking the box to the left and clicking 'fixed checked':

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O3 - Toolbar: (no name) - {0E677229-E309-4341-81BD-3CC3018BF5B3} - (no file)

O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVubmlz\command.exe (file missing)
O23 - Service: Remote Procedure Call Service (RPCS) - Unknown owner - C:\WINDOWS\rcss.exe (file missing)

Then reboot and a new log please.

Go to add/remove programs and look for New.Net or NewDot.Net and remove if present.

Next

Click Start > Run

In the box, type in services.msc then hit (or click OK)

In the Name column, look for Command Service

it.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled, then click Apply then OK.

Then do the same for Remote Procedure Call Service

Scan with hijackthis and put a check beside these lines and choose FIX

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O3 - Toolbar: (no name) - {0E677229-E309-4341-81BD-3CC3018BF5B3} - (no file)
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)

O4 - HKLM\..\Run: [xmj] C:\WINDOWS\xmj.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [w37V35X] pidput.exe
O4 - HKLM\..\Run: [Uninstall_WinTools] C:\WINDOWS\Temp\WTuninst.exe /remove
O4 - HKLM\..\Run: [secure] C:\WINDOWS\system32\Itorkf.exe
O4 - HKLM\..\Run: [s8B] C:\documents and settings\emily\local settings\temp\s8B.exe
O4 - HKLM\..\Run: [ohfpF] C:\WINDOWS\skcgp.exe
O4 - HKLM\..\Run: [mgdpppws] c:\windows\system32\mgdpppws.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\system32\gah95on6.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1
O4 - HKCU\..\Run: [h0o9RRbnV] patutils.exe

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVubmlz\command.exe (file missing)
O23 - Service: Remote Procedure Call Service (RPCS) - Unknown owner - C:\WINDOWS\rcss.exe (file missing)


Next reboot to safe mode (tap f8 while bios loads) look for and delete these files/folders if present

C:\WINDOWS\xmj.exe C:\Program Files\WildTangent C:\WINDOWS\Temp\WTuninst.exe C:\WINDOWS\system32\Itorkf.exe C:\documents and settings\emily\local settings\temp\s8B.exe C:\WINDOWS\skcgp.exe c:\windows\system32\mgdpppws.exe C:\Program Files\ipwins\ipwins.exe C:\WINDOWS\system32\gah95on6.exe C:\PROGRA~1\AWS\WEATHE~
Then reboot and a new log please.

O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE

Name ScsiAccess
Command ScsiAccess.EXE
Status Legitimate
Description Alcohol Software's CD/DVD writing application


Download the trial version of trojan hunter from the link below. Update it scan your system and allow it to clean what it finds.

http://www.trojanhunter.com/

Let me know if it finds something it can not remove.


I will be out of town for a few days and will not be able to respond.

Hope you had a good couple days away from all this madness. Per your instructions, I went to trojanhunter.com. I downloaded the trial version of pctool’s Spyware Doctor. I ran the scan and it found quite a lot of stuff. Unfortunately, I couldn’t remove these without purchasing the software, but that ended up being the best 30 bucks I’ve ever spent. The software found the following items: IncrediFind – Hijacker Transponder.Speer DollarRevenue – Trojan MediaLoads Enhancer Worm.WGAVIN Network Monitor (Command Webroot) IST Bar - Trojan Downloader It found tons of other stuff, but these were considered severe threats. The Worm (Backdoor.Win32.IRC Bot.st) is an instant messaging worm and was said to be capable of turning off the system firewall. I removed all these items and regained control over my firewall!!! I ran this program for all the users on my home computer, and found and removed tons of additional carp** from each. I have re-run every other virus and spyware program I have and the system appears to be clean. Everything seems to be working fine now. You are a god in my book! Thank you for all your help. I will definitely donate at the link below. You folks are the “good guys” in the fight against the sleaze bags that create vile things like Trojans and Hijackers. Us “regular folks” would be screwed without you Thanks again, Dennis

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php