tagasaurus

Hello and welcome to the forum.

Sorry about the delay in responding

If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread.

Also please describe how your computer behaves at the moment.

Please use the [external image: Posted Image] Button below to reply. Thanks

Download DelDomains.inf
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click and select….. Save Target As….Save

To use: Right-click and select……. Install (no need to restart)
**Note** This will remove all entries in the "Trusted Zone"

Mext:

* Download Combofix to your desktop.
Doubleclick combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

here is the combofix log: matt - 06-09-24 13:03:51.02 Service Pack 1 ComboFix 06.09.23.2 - Running from: "C:\Documents and Settings\matt\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\ECURIT~1 C:\QooBox\Purity\WINDOWS\SSEMBL~1 C:\QooBox\Purity\WINDOWS\system32\RACLE~1 C:\QooBox\Purity\WINDOWS\system32\TSKS~1 C:\QooBox\Purity\WINDOWS\system32\TSKS~1\explorer.exe C:\QooBox\Purity\WINDOWS\system32\TSKS~1\T?sks ((((((((((((((((((((((((((((((( Files Created from 2006-08-24 to 2006-09-24 )))))))))))))))))))))))))))))))))) 2006-09-24 12:58 358 –a—— C:\Combo.bat 2006-09-23 19:30 126,976 –a—— C:\WINDOWS\system32\tnz.dll 2006-09-22 16:51 2 –a—— C:\WINDOWS\system32\winttr.exe 2006-09-18 07:32 80,896 –a—— C:\WINDOWS\system32\nso8.dll 2006-09-16 19:57 465,176 –a—— C:\WINDOWS\system32\wuapi.dll 2006-09-16 19:57 41,240 –a—— C:\WINDOWS\system32\wups.dll 2006-09-16 19:57 194,328 –a—— C:\WINDOWS\system32\wuaueng1.dll 2006-09-16 19:57 18,200 –a—— C:\WINDOWS\system32\wups2.dll 2006-09-16 19:57 172,312 –a—— C:\WINDOWS\system32\wuauclt1.exe 2006-09-16 19:57 127,256 –a—— C:\WINDOWS\system32\wucltui.dll 2006-09-16 18:38 146,432 –a—— C:\WINDOWS\system32\regedit.exe 2006-09-15 19:30 743,728 -r-hs—- C:\WINDOWS\sfjzgkl.exe 2006-09-15 19:30 734,816 -r-hs—- C:\WINDOWS\sfjzgklA.exe 2006-09-15 19:29 566,864 -r-hs—- C:\WINDOWS\vhopcozA.exe 2006-09-15 19:29 547,824 -r-hs—- C:\WINDOWS\vhopcoz.exe 2006-09-15 19:29 517 –a—— C:\WINDOWS\lgecb.dll 2006-08-29 14:32 393,216 ——— C:\WINDOWS\system32\PVShared.dll 2006-08-29 14:32 368,912 ——— C:\WINDOWS\system32\vbar332.dll 2006-08-29 14:32 290,816 ——— C:\WINDOWS\system32\MSXBSE35.DLL 2006-08-29 14:32 254,976 ——— C:\WINDOWS\system32\MSEXCL35.DLL 2006-08-29 14:32 253,952 ——— C:\WINDOWS\system32\MSPDOX35.DLL 2006-08-29 14:32 183,296 ——— C:\WINDOWS\system32\crpaig32.dll 2006-08-29 14:32 169,984 ——— C:\WINDOWS\system32\MSLTUS35.DLL 2006-08-29 13:27 86,016 –a—— C:\WINDOWS\unvise32.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-09-24 11:57 ——– d——– C:\Program Files\Common Files 2006-09-23 13:07 ——– d——– C:\Program Files\AIM 2006-09-23 13:06 ——– d——– C:\Program Files\AOD 2006-09-17 22:09 ——– d——– C:\Program Files\Common Files\mqqk 2006-09-17 16:23 ——– d——– C:\Program Files\PrintView 2006-09-17 16:14 ——– d——– C:\Documents and Settings\matt\Application Data\Adobe 2006-09-17 12:13 ——– d——– C:\Documents and Settings\matt\Application Data\Google 2006-09-17 12:09 ——– d——– C:\Program Files\Google 2006-09-16 19:42 ——– d——– C:\Program Files\MSN Gaming Zone 2006-09-16 16:37 ——– d——– C:\Program Files\Windows Media Player 2006-09-16 16:37 ——– d——– C:\Program Files\ComPlus Applications 2006-09-16 16:37 ——– d——– C:\Program Files\Common Files\àdobe 2006-09-16 16:11 ——– d–h—– C:\Program Files\Common Files\cloader 2006-09-15 19:28 32135 —hs—- C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe 2006-09-13 18:20 ——– d——– C:\Program Files\LimeWire 2006-09-10 15:21 ——– d——– C:\Program Files\The Weather Channel FW 2006-09-10 15:20 ——– d——– C:\Documents and Settings\matt\Application Data\Real 2006-09-10 15:17 ——– d——– C:\Program Files\Real 2006-09-10 15:17 ——– d——– C:\Program Files\Common Files\xing shared 2006-09-10 15:17 ——– d——– C:\Program Files\Common Files\Real 2006-08-31 11:50 157184 —hs—- C:\Program Files\Common Files\Yazzle1281OinAdmin.exe 2006-08-29 14:33 ——– d——– C:\Program Files\Common Files\Adobe 2006-08-29 14:33 ——– d——– C:\Program Files\Adobe 2006-08-29 14:32 ——– d——– C:\Program Files\Prentice Hall 2006-08-29 14:29 ——– d——– C:\Program Files\Pearson_Prentice_Hall 2006-08-26 13:53 ——– d——– C:\Documents and Settings\matt\Application Data\ThinkWave Software 2006-08-21 12:10 ——– d——– C:\Program Files\ThinkWave 2006-08-21 12:10 ——– d——– C:\Program Files\Seagate Software 2006-08-21 12:10 ——– d——– C:\Program Files\Common Files\ThinkWave 2006-08-14 20:52 78848 –a—— C:\WINDOWS\system32\nsw4C.dll 2006-08-07 11:17 61440 –a—— C:\WINDOWS\system32\BattyRun2.dll 2006-07-16 12:35 299528 –a—— C:\57546148.exe 2006-07-04 23:32 299528 –a—— C:\16663120234.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "Regscan"="C:\\WINDOWS\\System32\\regscan.exe" "DW4"="\"C:\\Program Files\\The Weather Channel FW\\Desktop Weather\\DesktopWeather.exe\"" "Awor"="\"C:\\WINDOWS\\System32\\TSKS~1\\explorer.exe\" -vt yazb" "Ugb"="C:\\Program Files\\W?nSxS\\?xplorer.exe" "PSCloner"="\"C:\\Program Files\\PSCloner\\PSCloner.exe\"" "CMFibula"="\"C:\\Program Files\\CMFibula\\CMFibula.exe\"" "cprocsvc"="C:\\WINDOWS\\System32\\crunner\\cproc.exe" "Winsvr"="C:\\DOCUME~1\\matt\\LOCALS~1\\Temp\\stdrun125632.exe" "mqqk"="C:\\Program Files\\Common Files\\mqqk\\mqqkm.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "lich"="lich.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "ACTX1"="C:\\WINDOWS\\v1201.exe" "sys09680507445"="C:\\WINDOWS\\sys09680507445.exe" "sfjzgklA"="C:\\WINDOWS\\sfjzgklA.exe" "gwk741c8"="RUNDLL32.EXE w08e4781.dll,n 004741c40000000308e4781" "loaddr"="C:\\topaff.exe" "vhopcozA"="C:\\WINDOWS\\vhopcozA.exe" "xload"="\"C:\\WINDOWS\\xload.exe\"" "PVModule"="C:\\PROGRA~1\\PRINTV~1\\pvmodule.exe" "adstart"="\"iexplore.exe\" \"http://iesettingsupdate\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\ComPlus Applications\\vitejide.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows Media Player\\sary.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,06,01,00,00,30,00,00,00,c3,02,00,00,46,02,00,00,ec,\ 03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,06,01,00,00,30,00,00,00,c3,02,00,00,46,02,\ 00,00,01,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoActiveDesktop"=dword:00000000 "ClassicShell"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "DisableTaskMgr"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoActiveDesktopChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run] [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-09-24 13:08:26.18 ComboFix.txt ComboFix2.txt

You have quite a collection there:

Take your time and follow these instructions

First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

• Once you have downloaded ewido anti-spyware, locate the icon on the desktop
  and double-click it to launch the set up program.
• Once the setup is complete you will need run ewido and update the definition
  files.
• On the main screen select the icon "Update" then select the "
  Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of
  the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then
  select ""Quarantine".".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting
  your computer and continually tapping the F8 key until a menu appears.
  
  Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or
  programs while ewido is scanning, it may interfere with the scanning proccess:
• Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it to a text file on your system (make sure to remember where
  you saved that file, this is important).
• Close ewido and reboot your system back into Normal Mode.

Doubleclick combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished, it should produce a log, combofix.txt.

post the results of the ewido report scan, log combofix.txt and a new HijackThis log.

ewido anti-spyware - Scan Report ——————————————————— + Created at: 4:19:07 PM 9/24/2006 + Scan result: C:\WINDOWS\system32\BattyRun2.dll -> Adware.CASClient : No action taken. C:\WINDOWS\Downloaded Program Files\amm06.ocx -> Adware.MediaMotor : No action taken. HKLM\SOFTWARE\Classes\CLSID\{7CAF96A2-C556-460A-988E-76FC7895D284} -> Adware.SpyAxe : No action taken. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\UJ07T676\zl[1].anr -> Downloader.Ani.c : No action taken. C:\QooBox\duoak.exe.qoo -> Downloader.Qoologic.bj : No action taken. C:\QooBox\fskwq.exe.qoo -> Downloader.Qoologic.bj : No action taken. C:\QooBox\mlxvkg.exe.qoo -> Downloader.Qoologic.bj : No action taken. C:\QooBox\nqveuli.exe.qoo -> Downloader.Qoologic.bj : No action taken. C:\QooBox\rjmyv.dat.qoo -> Downloader.Qoologic.bj : No action taken. C:\QooBox\ssxvbot.dll.qoo -> Downloader.Qoologic.bj : No action taken. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\GHQRC1MB\al3[1].txt -> Downloader.Small : No action taken. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\GHQRC1MB\al3[2].txt -> Downloader.Small : No action taken. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\GHQRC1MB\al3[3].txt -> Downloader.Small : No action taken. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\WWS5SVE9\n[1].exe -> Downloader.Small.cpg : No action taken. C:\Program Files\Common Files\mqqk\mqqkp.exe -> Downloader.TSUpdate.f : No action taken. C:\Program Files\Common Files\mqqk\mqqka.exe -> Downloader.TSUpdate.l : No action taken. C:\Program Files\Common Files\mqqk\mqqkl.exe -> Downloader.TSUpdate.r : No action taken. C:\WINDOWS\sfjzgklA.exe -> Downloader.VB.alu : No action taken. C:\WINDOWS\vhopcozA.exe -> Downloader.VB.ang : No action taken. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\W7S1QNGP\popup[2].php -> Hijacker.Agent.a : No action taken. C:\Program Files\ComPlus Applications\vitejide.html -> Hijacker.Small.jf : No action taken. C:\Program Files\Windows Media Player\sary.html -> Hijacker.Small.jf : No action taken. C:\WINDOWS\sfjzgkl.exe -> Hijacker.VB.ij : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\matt\Cookies\matt@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\matt\Cookies\matt@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\matt\Cookies\matt@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\matt\Cookies\matt@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\matt\Cookies\matt@tcompany.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\matt\Cookies\matt@aavalue[2].txt -> TrackingCookie.Aavalue : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Aavalue : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@adbrite[2].txt -> TrackingCookie.Adbrite : No action taken. C:\Documents and Settings\matt\Cookies\matt@adbrite[2].txt -> TrackingCookie.Adbrite : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][2].txt -> TrackingCookie.Addynamix : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : No action taken. C:\Documents and Settings\matt\Cookies\matt@admarketplace[1].txt -> TrackingCookie.Admarketplace : No action taken. C:\Documents and Settings\matt\Cookies\matt@adrevolver[3].txt -> TrackingCookie.Adrevolver : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Adserver : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Adtrak : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Adtrak : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@advertising[1].txt -> TrackingCookie.Advertising : No action taken. C:\Documents and Settings\matt\Cookies\matt@advertising[1].txt -> TrackingCookie.Advertising : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\matt\Cookies\matt@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\matt\Cookies\matt@bluestreak[2].txt -> TrackingCookie.Bluestreak : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Bridgetrack : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][2].txt -> TrackingCookie.Burstbeacon : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@burstnet[2].txt -> TrackingCookie.Burstnet : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Burstnet : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Burstnet : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken. C:\Documents and Settings\matt\Cookies\matt@casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Coremetrics : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : No action taken. C:\Documents and Settings\matt\Cookies\matt@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Directnetadvertising : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@doubleclick[2].txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\matt\Cookies\matt@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Enhance : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Enhance : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Enhance : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Falkag : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Falkag : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@fastclick[1].txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\matt\Cookies\matt@fastclick[2].txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\matt\Cookies\matt@findwhat[1].txt -> TrackingCookie.Findwhat : No action taken. C:\Documents and Settings\LocalService\Cookies\[removed][2].txt -> TrackingCookie.Goclick : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][2].txt -> TrackingCookie.Goclick : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Goclick : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@hitbox[1].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\matt\Cookies\matt@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@kmpads[2].txt -> TrackingCookie.Kmpads : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Liveperson : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@mediaplex[2].txt -> TrackingCookie.Mediaplex : No action taken. C:\Documents and Settings\matt\Cookies\matt@mediaplex[2].txt -> TrackingCookie.Mediaplex : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Myaffiliateprogram : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@qksrv[2].txt -> TrackingCookie.Qksrv : No action taken. C:\Documents and Settings\matt\Cookies\matt@qksrv[1].txt -> TrackingCookie.Qksrv : No action taken. C:\Documents and Settings\matt\Cookies\matt@questionmarket[2].txt -> TrackingCookie.Questionmarket : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : No action taken. C:\Documents and Settings\matt\Cookies\matt@revenue[1].txt -> TrackingCookie.Revenue : No action taken. C:\Documents and Settings\matt\Cookies\matt@edge.ru4[1].txt -> TrackingCookie.Ru4 : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Searchingbooth : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@searchingbooth[2].txt -> TrackingCookie.Searchingbooth : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Searchingbooth : No action taken. C:\Documents and Settings\matt\Cookies\matt@serving-sys[1].txt -> TrackingCookie.Serving-sys : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Starware : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Starware : No action taken. C:\Documents and Settings\matt\Cookies\matt@statcounter[1].txt -> TrackingCookie.Statcounter : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@tacoda[2].txt -> TrackingCookie.Tacoda : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : No action taken. C:\Documents and Settings\matt\Cookies\matt@tacoda[2].txt -> TrackingCookie.Tacoda : No action taken. C:\Documents and Settings\matt\Cookies\matt@targetnet[2].txt -> TrackingCookie.Targetnet : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed]-banners[1].txt -> TrackingCookie.Top-banners : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@trafficmp[2].txt -> TrackingCookie.Trafficmp : No action taken. C:\Documents and Settings\matt\Cookies\matt@trafficmp[2].txt -> TrackingCookie.Trafficmp : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching time@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\matt\Cookies\matt@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Valuead : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Webtrendslive : No action taken. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][2].txt -> TrackingCookie.Yieldmanager : No action taken. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : No action taken. C:\Documents and Settings\matt\Cookies\matt@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken. C:\Documents and Settings\matt\Cookies\matt@zedo[1].txt -> TrackingCookie.Zedo : No action taken. ::Report end

matt - 06-09-24 16:26:51.57 Service Pack 1 ComboFix 06.09.23.2 - Running from: "C:\Documents and Settings\matt\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\ECURIT~1 C:\QooBox\Purity\WINDOWS\SSEMBL~1 C:\QooBox\Purity\WINDOWS\system32\RACLE~1 C:\QooBox\Purity\WINDOWS\system32\TSKS~1 C:\QooBox\Purity\WINDOWS\system32\TSKS~1\explorer.exe C:\QooBox\Purity\WINDOWS\system32\TSKS~1\T?sks ((((((((((((((((((((((((((((((( Files Created from 2006-08-24 to 2006-09-24 )))))))))))))))))))))))))))))))))) 2006-09-22 16:51 2 –a—— C:\WINDOWS\system32\winttr.exe 2006-09-18 07:32 80,896 –a—— C:\WINDOWS\system32\nso8.dll 2006-09-16 19:57 465,176 –a—— C:\WINDOWS\system32\wuapi.dll 2006-09-16 19:57 41,240 –a—— C:\WINDOWS\system32\wups.dll 2006-09-16 19:57 194,328 –a—— C:\WINDOWS\system32\wuaueng1.dll 2006-09-16 19:57 18,200 –a—— C:\WINDOWS\system32\wups2.dll 2006-09-16 19:57 172,312 –a—— C:\WINDOWS\system32\wuauclt1.exe 2006-09-16 19:57 127,256 –a—— C:\WINDOWS\system32\wucltui.dll 2006-09-16 18:38 146,432 –a—— C:\WINDOWS\system32\regedit.exe 2006-09-15 19:30 743,728 -r-hs—- C:\WINDOWS\sfjzgkl.exe 2006-09-15 19:29 547,824 -r-hs—- C:\WINDOWS\vhopcoz.exe 2006-09-15 19:29 517 –a—— C:\WINDOWS\lgecb.dll 2006-08-29 14:32 393,216 ——— C:\WINDOWS\system32\PVShared.dll 2006-08-29 14:32 368,912 ——— C:\WINDOWS\system32\vbar332.dll 2006-08-29 14:32 290,816 ——— C:\WINDOWS\system32\MSXBSE35.DLL 2006-08-29 14:32 254,976 ——— C:\WINDOWS\system32\MSEXCL35.DLL 2006-08-29 14:32 253,952 ——— C:\WINDOWS\system32\MSPDOX35.DLL 2006-08-29 14:32 183,296 ——— C:\WINDOWS\system32\crpaig32.dll 2006-08-29 14:32 169,984 ——— C:\WINDOWS\system32\MSLTUS35.DLL 2006-08-29 13:27 86,016 –a—— C:\WINDOWS\unvise32.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-09-24 15:01 ——– d——– C:\Program Files\ewido anti-spyware 4.0 2006-09-24 14:50 ——– d——– C:\Program Files\Common Files\mqqk 2006-09-24 11:57 ——– d——– C:\Program Files\Common Files 2006-09-23 13:07 ——– d——– C:\Program Files\AIM 2006-09-23 13:06 ——– d——– C:\Program Files\AOD 2006-09-17 16:23 ——– d——– C:\Program Files\PrintView 2006-09-17 16:14 ——– d——– C:\Documents and Settings\matt\Application Data\Adobe 2006-09-17 12:13 ——– d——– C:\Documents and Settings\matt\Application Data\Google 2006-09-17 12:09 ——– d——– C:\Program Files\Google 2006-09-16 19:42 ——– d——– C:\Program Files\MSN Gaming Zone 2006-09-16 16:37 ——– d——– C:\Program Files\Windows Media Player 2006-09-16 16:37 ——– d——– C:\Program Files\ComPlus Applications 2006-09-16 16:37 ——– d——– C:\Program Files\Common Files\àdobe 2006-09-16 16:11 ——– d–h—– C:\Program Files\Common Files\cloader 2006-09-15 19:28 32135 —hs—- C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe 2006-09-13 18:20 ——– d——– C:\Program Files\LimeWire 2006-09-10 15:21 ——– d——– C:\Program Files\The Weather Channel FW 2006-09-10 15:20 ——– d——– C:\Documents and Settings\matt\Application Data\Real 2006-09-10 15:17 ——– d——– C:\Program Files\Real 2006-09-10 15:17 ——– d——– C:\Program Files\Common Files\xing shared 2006-09-10 15:17 ——– d——– C:\Program Files\Common Files\Real 2006-08-31 11:50 157184 —hs—- C:\Program Files\Common Files\Yazzle1281OinAdmin.exe 2006-08-29 14:33 ——– d——– C:\Program Files\Common Files\Adobe 2006-08-29 14:33 ——– d——– C:\Program Files\Adobe 2006-08-29 14:32 ——– d——– C:\Program Files\Prentice Hall 2006-08-29 14:29 ——– d——– C:\Program Files\Pearson_Prentice_Hall 2006-08-26 13:53 ——– d——– C:\Documents and Settings\matt\Application Data\ThinkWave Software 2006-08-21 12:10 ——– d——– C:\Program Files\ThinkWave 2006-08-21 12:10 ——– d——– C:\Program Files\Seagate Software 2006-08-21 12:10 ——– d——– C:\Program Files\Common Files\ThinkWave 2006-08-14 20:52 78848 –a—— C:\WINDOWS\system32\nsw4C.dll 2006-08-07 11:17 61440 –a—— C:\WINDOWS\system32\BattyRun2.dll 2006-07-16 12:35 299528 –a—— C:\57546148.exe 2006-07-04 23:32 299528 –a—— C:\16663120234.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "Regscan"="C:\\WINDOWS\\System32\\regscan.exe" "DW4"="\"C:\\Program Files\\The Weather Channel FW\\Desktop Weather\\DesktopWeather.exe\"" "Awor"="\"C:\\WINDOWS\\System32\\TSKS~1\\explorer.exe\" -vt yazb" "Ugb"="C:\\Program Files\\W?nSxS\\?xplorer.exe" "PSCloner"="\"C:\\Program Files\\PSCloner\\PSCloner.exe\"" "CMFibula"="\"C:\\Program Files\\CMFibula\\CMFibula.exe\"" "cprocsvc"="C:\\WINDOWS\\System32\\crunner\\cproc.exe" "Winsvr"="C:\\DOCUME~1\\matt\\LOCALS~1\\Temp\\stdrun125632.exe" "mqqk"="C:\\Program Files\\Common Files\\mqqk\\mqqkm.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "lich"="lich.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "ACTX1"="C:\\WINDOWS\\v1201.exe" "sys09680507445"="C:\\WINDOWS\\sys09680507445.exe" "gwk741c8"="RUNDLL32.EXE w08e4781.dll,n 004741c40000000308e4781" "loaddr"="C:\\topaff.exe" "xload"="\"C:\\WINDOWS\\xload.exe\"" "PVModule"="C:\\PROGRA~1\\PRINTV~1\\pvmodule.exe" "adstart"="\"iexplore.exe\" \"http://iesettingsupdate\"" "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\ComPlus Applications\\vitejide.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows Media Player\\sary.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,06,01,00,00,30,00,00,00,c3,02,00,00,46,02,00,00,ec,\ 03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,06,01,00,00,30,00,00,00,c3,02,00,00,46,02,\ 00,00,01,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoActiveDesktop"=dword:00000000 "ClassicShell"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "DisableTaskMgr"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoActiveDesktopChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run] [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-09-24 16:31:22.48 ComboFix.txt ComboFix2.txt ComboFix3.txt

Why did you select "no action" on those infected files Ewido found?
You need to run Ewido again per the instructions.

You need to set the "Recommended actions" and then
select " "DELETE" .".


[*]Once you have downloaded ewido anti-spyware, locate the icon on the desktop

and double-click it to launch the set up program.
[*]Once the setup is complete you will need run ewido and update the definition

files.
[*]On the main screen select the icon "Update" then select the "

Update now" link.

• Next select the "Start Update" button, the update will start and a
  progress bar will show the updates being installed.

[*]Once the update has completed select the "Scanner" icon at the top of

the screen, then select the "Settings" tab.
[*]Once in the Settings screen click on "Recommended actions" and then

select " "DELETE" .".
[*]Under "Reports"

• Select "Automatically generate report after every scan"
• Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting
  your computer and continually tapping the F8 key until a menu appears.
  
  Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or
  programs while ewido is scanning, it may interfere with the scanning proccess:
• Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it to a text file on your system (make sure to remember where
  you saved that file, this is important).
• Close ewido and reboot your system back into Normal Mode and post the
  results of the ewido report scan along with a new HijackThis log.

Then run the combofix again.

post the results of the ewido report scan, log combofix.txt and a new HijackThis log.

ewido anti-spyware - Scan Report ——————————————————— + Created at: 6:46:29 PM 9/24/2006 + Scan result: C:\WINDOWS\system32\BattyRun2.dll -> Adware.CASClient : Cleaned. C:\WINDOWS\Downloaded Program Files\amm06.ocx -> Adware.MediaMotor : Cleaned. HKLM\SOFTWARE\Classes\CLSID\{7CAF96A2-C556-460A-988E-76FC7895D284} -> Adware.SpyAxe : Cleaned. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\UJ07T676\zl[1].anr -> Downloader.Ani.c : Cleaned. C:\QooBox\duoak.exe.qoo -> Downloader.Qoologic.bj : Cleaned. C:\QooBox\fskwq.exe.qoo -> Downloader.Qoologic.bj : Cleaned. C:\QooBox\mlxvkg.exe.qoo -> Downloader.Qoologic.bj : Cleaned. C:\QooBox\nqveuli.exe.qoo -> Downloader.Qoologic.bj : Cleaned. C:\QooBox\rjmyv.dat.qoo -> Downloader.Qoologic.bj : Cleaned. C:\QooBox\ssxvbot.dll.qoo -> Downloader.Qoologic.bj : Cleaned. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\GHQRC1MB\al3[1].txt -> Downloader.Small : Cleaned. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\GHQRC1MB\al3[2].txt -> Downloader.Small : Cleaned. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\GHQRC1MB\al3[3].txt -> Downloader.Small : Cleaned. C:\Documents and Settings\matt\Local Settings\Temporary Internet Files\Content.IE5\WWS5SVE9\n[1].exe -> Downloader.Small.cpg : Cleaned. C:\Program Files\Common Files\mqqk\mqqkp.exe -> Downloader.TSUpdate.f : Cleaned. C:\Program Files\Common Files\mqqk\mqqka.exe -> Downloader.TSUpdate.l : Cleaned. C:\Program Files\Common Files\mqqk\mqqkl.exe -> Downloader.TSUpdate.r : Cleaned. C:\Program Files\ComPlus Applications\vitejide.html -> Hijacker.Small.jf : Cleaned. C:\Program Files\Windows Media Player\sary.html -> Hijacker.Small.jf : Cleaned. C:\WINDOWS\sfjzgkl.exe -> Hijacker.VB.ij : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\matt\Cookies\matt@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\matt\Cookies\matt@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\matt\Cookies\matt@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\matt\Cookies\matt@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\matt\Cookies\matt@tcompany.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\matt\Cookies\matt@aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Aavalue : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\matt\Cookies\matt@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][2].txt -> TrackingCookie.Addynamix : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : Cleaned. C:\Documents and Settings\matt\Cookies\matt@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned. C:\Documents and Settings\matt\Cookies\matt@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Adtrak : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Adtrak : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@advertising[1].txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\matt\Cookies\matt@advertising[2].txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\matt\Cookies\matt@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\matt\Cookies\matt@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][2].txt -> TrackingCookie.Burstbeacon : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Documents and Settings\matt\Cookies\matt@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Coremetrics : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned. C:\Documents and Settings\matt\Cookies\matt@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Directnetadvertising : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\matt\Cookies\matt@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Enhance : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Falkag : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\matt\Cookies\matt@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\matt\Cookies\matt@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned. C:\Documents and Settings\LocalService\Cookies\[removed][2].txt -> TrackingCookie.Goclick : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][2].txt -> TrackingCookie.Goclick : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Goclick : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\matt\Cookies\matt@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@kmpads[2].txt -> TrackingCookie.Kmpads : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Liveperson : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\matt\Cookies\matt@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned. C:\Documents and Settings\matt\Cookies\matt@qksrv[1].txt -> TrackingCookie.Qksrv : Cleaned. C:\Documents and Settings\matt\Cookies\matt@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned. C:\Documents and Settings\matt\Cookies\matt@revenue[1].txt -> TrackingCookie.Revenue : Cleaned. C:\Documents and Settings\matt\Cookies\matt@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][1].txt -> TrackingCookie.Searchingbooth : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@searchingbooth[2].txt -> TrackingCookie.Searchingbooth : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Searchingbooth : Cleaned. C:\Documents and Settings\matt\Cookies\matt@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Starware : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned. C:\Documents and Settings\matt\Cookies\matt@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\matt\Cookies\matt@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\matt\Cookies\matt@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed]-banners[1].txt -> TrackingCookie.Top-banners : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Documents and Settings\matt\Cookies\matt@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching time@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\matt\Cookies\matt@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][2].txt -> TrackingCookie.Valuead : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned. C:\Documents and Settings\Teaching Time\Cookies\teaching [removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Documents and Settings\matt\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Documents and Settings\matt\Cookies\matt@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Documents and Settings\matt\Cookies\matt@zedo[1].txt -> TrackingCookie.Zedo : Cleaned. ::Report end

Much better Can you run the combofix again and post the results along with a new HijackThis log.

matt - 06-09-24 18:50:03.58 Service Pack 1 ComboFix 06.09.23.2 - Running from: "C:\Documents and Settings\matt\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\ECURIT~1 C:\QooBox\Purity\WINDOWS\SSEMBL~1 C:\QooBox\Purity\WINDOWS\system32\RACLE~1 C:\QooBox\Purity\WINDOWS\system32\TSKS~1 C:\QooBox\Purity\WINDOWS\system32\TSKS~1\explorer.exe C:\QooBox\Purity\WINDOWS\system32\TSKS~1\T?sks ((((((((((((((((((((((((((((((( Files Created from 2006-08-24 to 2006-09-24 )))))))))))))))))))))))))))))))))) 2006-09-22 16:51 2 –a—— C:\WINDOWS\system32\winttr.exe 2006-09-18 07:32 80,896 –a—— C:\WINDOWS\system32\nso8.dll 2006-09-16 19:57 465,176 –a—— C:\WINDOWS\system32\wuapi.dll 2006-09-16 19:57 41,240 –a—— C:\WINDOWS\system32\wups.dll 2006-09-16 19:57 194,328 –a—— C:\WINDOWS\system32\wuaueng1.dll 2006-09-16 19:57 18,200 –a—— C:\WINDOWS\system32\wups2.dll 2006-09-16 19:57 172,312 –a—— C:\WINDOWS\system32\wuauclt1.exe 2006-09-16 19:57 127,256 –a—— C:\WINDOWS\system32\wucltui.dll 2006-09-16 18:38 146,432 –a—— C:\WINDOWS\system32\regedit.exe 2006-09-15 19:29 547,824 -r-hs—- C:\WINDOWS\vhopcoz.exe 2006-09-15 19:29 517 –a—— C:\WINDOWS\lgecb.dll 2006-08-29 14:32 393,216 ——— C:\WINDOWS\system32\PVShared.dll 2006-08-29 14:32 368,912 ——— C:\WINDOWS\system32\vbar332.dll 2006-08-29 14:32 290,816 ——— C:\WINDOWS\system32\MSXBSE35.DLL 2006-08-29 14:32 254,976 ——— C:\WINDOWS\system32\MSEXCL35.DLL 2006-08-29 14:32 253,952 ——— C:\WINDOWS\system32\MSPDOX35.DLL 2006-08-29 14:32 183,296 ——— C:\WINDOWS\system32\crpaig32.dll 2006-08-29 14:32 169,984 ——— C:\WINDOWS\system32\MSLTUS35.DLL 2006-08-29 13:27 86,016 –a—— C:\WINDOWS\unvise32.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-09-24 18:46 ——– d——– C:\Program Files\ComPlus Applications 2006-09-24 16:34 ——– d——– C:\Documents and Settings\matt\Application Data\Adobe 2006-09-24 15:01 ——– d——– C:\Program Files\ewido anti-spyware 4.0 2006-09-24 14:50 ——– d——– C:\Program Files\Common Files\mqqk 2006-09-24 11:57 ——– d——– C:\Program Files\Common Files 2006-09-23 13:07 ——– d——– C:\Program Files\AIM 2006-09-23 13:06 ——– d——– C:\Program Files\AOD 2006-09-17 16:23 ——– d——– C:\Program Files\PrintView 2006-09-17 12:13 ——– d——– C:\Documents and Settings\matt\Application Data\Google 2006-09-17 12:09 ——– d——– C:\Program Files\Google 2006-09-16 19:42 ——– d——– C:\Program Files\MSN Gaming Zone 2006-09-16 16:37 ——– d——– C:\Program Files\Windows Media Player 2006-09-16 16:37 ——– d——– C:\Program Files\Common Files\àdobe 2006-09-16 16:11 ——– d–h—– C:\Program Files\Common Files\cloader 2006-09-15 19:28 32135 —hs—- C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe 2006-09-13 18:20 ——– d——– C:\Program Files\LimeWire 2006-09-10 15:21 ——– d——– C:\Program Files\The Weather Channel FW 2006-09-10 15:20 ——– d——– C:\Documents and Settings\matt\Application Data\Real 2006-09-10 15:17 ——– d——– C:\Program Files\Real 2006-09-10 15:17 ——– d——– C:\Program Files\Common Files\xing shared 2006-09-10 15:17 ——– d——– C:\Program Files\Common Files\Real 2006-08-31 11:50 157184 —hs—- C:\Program Files\Common Files\Yazzle1281OinAdmin.exe 2006-08-29 14:33 ——– d——– C:\Program Files\Common Files\Adobe 2006-08-29 14:33 ——– d——– C:\Program Files\Adobe 2006-08-29 14:32 ——– d——– C:\Program Files\Prentice Hall 2006-08-29 14:29 ——– d——– C:\Program Files\Pearson_Prentice_Hall 2006-08-26 13:53 ——– d——– C:\Documents and Settings\matt\Application Data\ThinkWave Software 2006-08-21 12:10 ——– d——– C:\Program Files\ThinkWave 2006-08-21 12:10 ——– d——– C:\Program Files\Seagate Software 2006-08-21 12:10 ——– d——– C:\Program Files\Common Files\ThinkWave 2006-08-14 20:52 78848 –a—— C:\WINDOWS\system32\nsw4C.dll 2006-07-16 12:35 299528 –a—— C:\57546148.exe 2006-07-04 23:32 299528 –a—— C:\16663120234.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "Regscan"="C:\\WINDOWS\\System32\\regscan.exe" "DW4"="\"C:\\Program Files\\The Weather Channel FW\\Desktop Weather\\DesktopWeather.exe\"" "Awor"="\"C:\\WINDOWS\\System32\\TSKS~1\\explorer.exe\" -vt yazb" "Ugb"="C:\\Program Files\\W?nSxS\\?xplorer.exe" "PSCloner"="\"C:\\Program Files\\PSCloner\\PSCloner.exe\"" "CMFibula"="\"C:\\Program Files\\CMFibula\\CMFibula.exe\"" "cprocsvc"="C:\\WINDOWS\\System32\\crunner\\cproc.exe" "Winsvr"="C:\\DOCUME~1\\matt\\LOCALS~1\\Temp\\stdrun125632.exe" "mqqk"="C:\\Program Files\\Common Files\\mqqk\\mqqkm.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "lich"="lich.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "ACTX1"="C:\\WINDOWS\\v1201.exe" "sys09680507445"="C:\\WINDOWS\\sys09680507445.exe" "gwk741c8"="RUNDLL32.EXE w08e4781.dll,n 004741c40000000308e4781" "loaddr"="C:\\topaff.exe" "xload"="\"C:\\WINDOWS\\xload.exe\"" "PVModule"="C:\\PROGRA~1\\PRINTV~1\\pvmodule.exe" "adstart"="\"iexplore.exe\" \"http://iesettingsupdate\"" "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\ComPlus Applications\\vitejide.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows Media Player\\sary.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,06,01,00,00,30,00,00,00,c3,02,00,00,46,02,00,00,ec,\ 03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,06,01,00,00,30,00,00,00,c3,02,00,00,46,02,\ 00,00,01,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoActiveDesktop"=dword:00000000 "ClassicShell"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "DisableTaskMgr"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoActiveDesktopChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run] [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-09-24 18:54:29.82 ComboFix.txt ComboFix2.txt ComboFix3.txt