Help with my HijackThis log

Hello Swordbreaker,

Please tell me what to remove and which processes should I stop running via "msconfig".

I do not see any malware in your hijackthis log. What problems are you experiencing? Is your system just running slow and you are wanting to speed it up by disabling or removing processes?

Hello Swordbreaker,

Please tell me what to remove and which processes should I stop running via "msconfig".

I do not see any malware in your hijackthis log. What problems are you experiencing? Is your system just running slow and you are wanting to speed it up by disabling or removing processes?

Thanks for taking your time to do this, Susan528.

The only problem I'm experiencing is a slow start-up. I also sometimes I get scripting errors with a few of my programs like HP or Yahoo messenger, but I don't think that that's related to malware.

So yeah…I just wanted to be sure that I don't have any malware and I do want to speed-up my start-up.

Thanks again.

Okay, I will review your log and find entries that can be removed from start-up then.

Hello Swordbreaker,

I apologize that I have not replied sooner.

Your hijackthis log did not show signs of malware, however I would recommend running SpySweeper and Ewido just to check.

STEP 1.
======
SpySweeper
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

If you are taken to the internet page, just close the page.

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.


STEP 2.
======
The Ewido program’s detection rate is excellent. After the Trial has expired, the auto updates and real time protection stop but you can still update it manually and run scans anytime you want.

First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

• Once you have downloaded ewido anti-spyware, locate the icon on the desktop
  and double-click it to launch the set up program.
• Once the setup is complete you will need run ewido and update the definition
  files.
• On the main screen select the icon "Update" then select the "
  Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of
  the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then
  select "Quarantine".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting
  your computer and continually tapping the F8 key until a menu appears.
  
  Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or
  programs while ewido is scanning, it may interfere with the scanning proccess:
• Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it to a text file on your system (make sure to remember where
  you saved that file, this is important).
• Close ewido and reboot your system back into Normal Mode and post the
  results of the ewido report scan.

Empty Recycle Bin
Reboot


Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
• Click on Tools, General Settings.
• Under Real-time protection options, unselect the Turn on real-time protection check box
• Click Save

After all of the fixes are complete it is very important that you enable Real-time Protection again.

Scan with HijackThis. Place a check against each of the following:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\dapbho.dll

Blue are optional fixes but may improve performance.
This is RealPlayer's autoupdate program and is not necessary for the program to function properly. It is considered to be a resource hog. You will still be able to start it manually if you need it.
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" –osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.


Quick Time places an icon in the system tray for quick access to Apple QuickTime. It is not necessary since QuickTime may be run manually even without the tray icon. If you choose to remove it, you will also have to disable it from within QuickTime, in the following manner:
1) Run QuickTime from the Start -> Programs menu
2) Click on the Edit menu, then Preferences
3) Select QuickTime Preferences from the right-hand side menu
4) Uncheck the box next to "QuickTime System Tray Icon", and click OK.


To disable Real Player which is a resource hog after fixing the entry so it doesn't return, goto Start Menu > All Programs > Real Player > Click Tools then Preferences. Goto The Automatic Services and uncheck all boxes. Do the same for the AutoUpdate & Message Center tabs and press OK then exit.
_________________

Please post the results from SpySweeper, ewido and a new hijackthis log.

Hello SwordBreaker,

I would probably keep SpySweeper until the trial runs out.

Disable SpySweeper:
You have SpySweeper installed. While this is a great program, we need to temporarily disable (not uninstall) the program because it might stop our fix.
Right click on the SpySweeper icon in your System Tray (near the clock).
From the pop up menu, left click on Shields, this will open the program at the same time.
Click the "Internet Explorer" tab and uncheck the following:

• IE Favorites Shield
• IE Security Shield
• Broswer Helper Object (BHO) Shield
• IE Hijack Shield

Click the "Windows System Shields" and uncheck the following:

• Memory Shield
• Spy Installation Shield

Click the "Startup Programs" tab and uncheck the Startup Items Shield


Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
• Click on Tools, General Settings.
• Under Real-time protection options, unselect the Turn on real-time protection check box
• Click Save

Updating Java

• Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-1_5_0_08-windowsi586-p.exe to install the newest version.

Scan with HijackThis. Place a check against each of the following:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Enable SpySweeper and Windows Defender again.


Post back a fresh HijackThis log and we will take another look. Yes, Spyware Guard and Spyware Blaster are useful and I would recommend them.

Oops. Tripled posted the results by mistake. Disregard this post.

Oops. Triple posted the results by mistake. Disregard this Post.

Hello Swordbreaker,

I am not sure why those files are not being deleted. But the entries are incomplete and not harmful. It's more tidying-up-the-log work. Let's do another scan please.

Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Standard
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan:
• Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.

Copy and paste that information from Kapersky in your next post.

Hey Susan. Here are the results of the scan. KASPERSKY ONLINE SCANNER REPORT Thursday, August 24, 2006 10:41:31 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 24/08/2006 Kaspersky Anti-Virus database records: 205261 Scan Settings Scan using the following antivirus database standard Scan Archives true Scan Mail Bases true Scan Target My Computer C:\ D:\ Scan Statistics Total number of scanned objects 75902 Number of viruses found 0 Number of infected objects 0 / 0 Number of suspicious objects 0 Duration of the scan process 01:09:40 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Protection Service\edb.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Protection Service\MPSSVCPolicyIdLog.etl Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-05222006-040854.log Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS04272723-DA64-42B9-9952-FD0ECDD5B2E1.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1080EA82-5A3C-472B-BFF5-3B79261B8787.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS15E223A0-F569-4D8D-BFA4-F256C2506FC5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1C96C7B4-A081-4215-8672-4CE1ED8A9109.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1C9CF5B0-7824-47A2-9C52-FD1B3D8AF338.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1DAC110E-63E3-4F94-8324-4C5EC2F615B2.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1E353CFB-0EB5-47E4-B2CA-CD4FE3B6591C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1EF96F25-98C0-47F9-AE69-E645D2045E09.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1F949AB4-66C0-4C77-B957-2DA621FBC8F3.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS22C25102-C0C8-4570-9F59-EF6D3597F6AC.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS23265231-935E-41D3-A9C3-BDA014D37CF0.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS28808CA5-44DA-460F-BF16-8BB35F4BE1DE.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2B5076C0-489D-48C0-913B-78DE2CDAF519.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2C210374-F74B-4D7C-A52F-ADE679D9DC7B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2E6EEF2C-B2FD-4C13-B925-5943F6834DB5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS309A00C3-3D0A-4DCA-822C-29F8850F1AB2.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS33CF0E39-E49C-442F-9856-423B636E4FAA.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS350C320D-D54D-4456-9876-1332EB69928E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS36C5AD18-77C3-49AE-8D05-3AB7DE2CA275.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3B195336-0745-4917-8A2B-5EE40A943DBD.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3D4B0383-00AB-4061-A2B5-C35BC8625C2C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3D69B2DF-0691-4ED2-9C14-6B117BDF6C3C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS402B1A11-335D-4707-89B4-AA91CE095DF8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS48FC638A-1C53-4C60-8F29-EDAABF5DB316.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4A623102-5D0C-445B-AC13-23285ADB71F1.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4C9D6E99-F913-44B2-B268-3A9EB87F24BD.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4F8B1B94-2A00-440D-A0FF-52B076262D6D.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS54069211-BC48-4663-B4C3-C9F53B694FA6.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS58D08E94-61C1-4EA9-AEF2-2EA4F0E387C2.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5A773F4D-AD39-4D4B-B435-5FB2C05C4B88.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5A9923FC-F06D-4D0C-90DF-965E7E3E5033.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5C3C45FE-B464-4DB4-8B24-FE2253D9514F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5DC62572-432A-49AC-A6E4-59D2C80EB3A4.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS605C06A1-6D58-4809-B731-5A3AC6E06F3E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS649F82FE-BC2D-4158-B1A6-31C4F42227C3.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS65CF5B8A-B966-4F7E-83C8-E40D2BB2A912.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS68FD2D92-50E7-4430-8DB6-132267AA1650.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS6989B2FA-98B0-4E64-AF64-B2E78ABCB5E0.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS69BD3E13-C511-4492-BC35-919BB9182573.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS69F52F62-72FD-4AC2-ADE6-5FE861F6814A.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS6D5B8102-AB41-41D9-B24E-40BA99B2438A.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS6F1BE717-5527-4422-91B9-2F95BB8C1D99.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS701B78D6-FE68-45C0-927B-CED8EC22E16C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS7098176C-2CE7-46CF-9116-C8824CC99334.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS710D56E3-AB6A-4E66-9598-135104A081E2.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS714A3019-61A7-47C5-851D-494CE1F59BFE.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS730839A4-AB79-4B5F-B1D5-C85A3E565241.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS730E7DB3-73F2-4B0B-93C4-B97B54302FE7.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS78652235-9C72-49E4-AF96-CD86394239BE.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS7A807AF5-C2CA-45DA-B70B-3AB807097FDB.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS7B6A8B9D-84B3-4D85-8B46-936C4306A3F5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8094B044-FCD6-422B-B187-754C9FC137F4.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8166797A-2908-4C04-9356-9AA858FB76F8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS837DE481-AF7B-49B8-9DE8-34CC56467597.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS84ABEE5A-DFA0-4D97-8E28-D06369900690.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS868AC090-6026-4611-88F1-BD0F3346AC35.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS87751A52-5E40-489E-B335-545B773EE3BC.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS88A5C0D4-C471-4951-ABE4-D31BA075182E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS88C6D8C6-4854-4D38-8F39-A2435EF409F8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8C6328E9-DEC3-444B-8D4C-AA3C6FB137A6.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8E8A0439-525E-48C5-B012-3BC23C9FB7B2.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS920388E0-BAAF-4336-8BB9-3D5E4B9500FA.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS923603B0-B9D0-426F-96B4-BAA7CE538FF5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS940C06CF-A7C1-442E-8AE3-7DA28CFBEB89.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS96047BBA-34A4-40DE-8DC4-F36BA8F07A40.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS97B87CED-6041-43DF-8D5E-A71E195CBD74.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9B837CB5-2C7F-4EF6-A373-4868812F8DB1.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9EBF3048-9931-4AF7-AF24-1F39B60F3291.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9FF38088-05DA-44C1-B7E7-68B13EC8E791.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA31EBDCF-4829-45FB-9393-F7306FD2D199.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA474BB22-DADD-4D95-BFA6-A66069F08FE6.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA67B3D38-3FBA-400B-A29F-4D9989A1D147.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA790E56B-42E9-4A8E-B69F-03FDB0D8EB66.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSAA3F734D-AB88-4A12-960D-DF2AE9E00B1B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSABF8DE35-9E5C-481A-995C-D8F48904CE01.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSADFBA616-D9A0-431F-845F-8EB9EF3988B4.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSAE222398-425A-49DD-A02A-B7A57455AE1F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSAF051417-FD57-4502-9F30-DD3858590FCC.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB2CB44E8-98B2-4084-AB01-ED3BB69449E0.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB2E38BF0-5B80-4AF5-99CA-6B73B6B83E23.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB8F1BDBA-339C-4262-905B-1E6670AFDCA6.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB954B133-7415-4EB4-962C-07967EA5B945.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB9C8C5F5-955C-457D-BC3F-E3F46A2E6A00.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSBF6F48A0-ACF4-4A08-8920-86A03486B42C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC3B53392-38F8-4C0E-94A9-68F9224128D8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC3C4C557-FAF5-4428-8A14-F158598B36D8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC41634F4-2B20-4331-BAEE-E45598AD9C49.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC477542E-CF71-44A7-BE05-A81A1C2C880C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC5A0EABF-ACE5-4DC2-A799-27DC4F21D63D.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC8CCDD21-5816-4AA5-8496-B7C789BF73AF.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCDA3C3EA-82A3-40FC-9959-6EDA271A6201.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCEEEE76F-3A7F-479C-814C-B9D30FDD8F6C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD00D71E9-6061-44E0-9D5D-3FE41D53FA9F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD3854CB4-A1E9-4738-A36F-4A1A72816819.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD4D10DBA-4FF8-4900-A6B7-0076DBD6953B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD8AED989-89BA-44F1-879A-0551AADC4435.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDE3D8DAF-A76F-4475-8B41-C8C4377FF9F5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDF44333E-9F09-44A3-8152-DCF1BFC440B8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDFD24B97-C0F3-49F9-90B7-285D3376BDF3.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDFF87CF3-DDAE-4BBD-BBEE-078D1D4DF30B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE6BA316B-C8FD-4B09-9601-708F73AB6637.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE70A2C74-96EC-49A4-9B6D-6E2BE7D78F72.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSEE575BA6-7361-4CC1-B0E0-9948231330CD.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF58D692C-111D-4C1D-A4F1-7F41F243BB64.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF625610A-FC3A-4C32-9B5B-DA03A19D743E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF7BDE4B0-90B2-4FD0-BB75-13F42020AF3B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF955AAEA-686B-4A9D-88EC-F7A0FD97B4D6.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSFB2CD8FD-F443-467D-BDE0-251AE0ADCC02.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSFE8583D9-904A-49B3-BC9A-A27B603B8814.tmp Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\TOSHIBA\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\cert8.db Object is locked skipped C:\Documents and Settings\TOSHIBA\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\flashgot.log Object is locked skipped C:\Documents and Settings\TOSHIBA\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\history.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\key3.db Object is locked skipped C:\Documents and Settings\TOSHIBA\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\parent.lock Object is locked skipped C:\Documents and Settings\TOSHIBA\Application Data\Webroot\Spy Sweeper\Logs\060821064028.ses Object is locked skipped C:\Documents and Settings\TOSHIBA\Cookies\index.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Feeds\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\infected.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Logs\Dfsr.log Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\pending.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_4CB4_BDBA_B4BD_A73C\dfsr.db Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_4CB4_BDBA_B4BD_A73C\fsr.log Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_4CB4_BDBA_B4BD_A73C\fsrtmp.log Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_4CB4_BDBA_B4BD_A73C\tmp.edb Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{EA7B6D46-F744-48B3-8FFD-EAA2923BAC0D} Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\real\members.stg Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\shadow\members.stg Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Application Data\Mozilla\Firefox\Profiles\uebpqmtq.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\History\History.IE5\MSHist012006082420060825\index.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temp\Perflib_Perfdata_7e8.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DF12B2.tmp Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DF805B.tmp Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DF8071.tmp Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DFB656.tmp Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DFE6C7.tmp Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DFFE4A.tmp Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temporary Internet Files\AntiPhishing\07FB382D-AA75-4683-82F4-EAB265A275CB.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temporary Internet Files\Content.IE5\2R1A7Y7X\menuitem_us_pe_2[1].htm Object is locked skipped C:\Documents and Settings\TOSHIBA\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\TOSHIBA\NTUSER.DAT Object is locked skipped C:\Documents and Settings\TOSHIBA\ntuser.dat.LOG Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Ent.dat Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\ClientSD\prov\prov.xml Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\ClientSD\prov\Service.xml Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\ClientSD\prov\service.xml.bak Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\ClientSD\prov\user.xml Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\ClientSD\prov\user.xml.bak Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\Database\edb.log Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\Database\tmp.edb Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\Database\WinSS_st.edb Object is locked skipped C:\Program Files\Microsoft Windows OneCare Live\WinSSSvc_log.bin Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{145A78D9-30F3-4441-A76F-9F54405CDEA6}\RP39\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\MSFWSVC.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\Windows_OneCare_Evt.evt Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Congratulations Swordbreaker,

Your logs appear to be clean. Please do the following to help prevent infection.

STEP 1.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Test your Firewall - Please test your firewall and make sure it is working properly.
  Test Firewall
  
  
• Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  A tutorial on installing & using this product can be found here:
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  A tutorial on installing & using this product can be found here:
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  A tutorial on installing & using this product can be found here:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
  
  
• More info on how to prevent malware you can also find here (By Tony Klein)

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php