Help in Removal of Spyware/Trojan Alert

Download and install AVG Anti-Spyware (ewido). Then scan and post the report here.
Instructions and download link can be found here.

Close all programs leaving only HijackThis running. Place a check against each of the following,
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
Click on Fix Checked when finished and exit HijackThis.

Hi, Some additional info which could be of help. I truly appreciate your help in resolving my issues. Along with the HijackThis log I also ran Spyware doctor and it says : There is something called 'Marketscore Newsletter' which is playing havoc along with system32\rlls.dll. Also there is URLBlaze Adware Bundler There are entries into the HKCR directory.and the HKCU\Software\SNO2 and SNO2## Then there is this guy the AdRotator in HKCU\Software\Microsoft\Rotator

1. Download combofix.exe from one of the links below:

http://download.bleepingcomputer.com/sUBs/combofix.exe
http://www.techsupportforum.com/sectools/combofix.exe

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Dear Little Eagle, Please find attached the log. The virus like 'Marketscore Netsetter', 'URLBlaze Adware Bundler', 'AdRotator'. Not sure how close I'm towards completion as I need to have it done by Monday.Thanks again for your help. ==================================== TCS - 06-11-25 13:42:09.67 Service Pack 2 ComboFix 06.11.22 - Running from: "C:\Vinod" ((((((((((((((((((((((((((((((( Files Created from 2006-10-25 to 2006-11-25 )))))))))))))))))))))))))))))))))) 2006-11-25 09:46 d——– C:\Documents and Settings\TCS\.java 2006-11-25 08:38 d——– C:\WINDOWS\LastGood 2006-11-25 08:15 d——– C:\Program Files\MSXML 4.0 2006-11-25 08:14 d——– C:\919ff27c688eeeb42e6e 2006-11-24 21:22 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-11-24 21:22 d——– C:\Program Files\Grisoft 2006-11-24 17:03 d——– C:\Hjt 2006-11-23 13:00 221,184 –a—— C:\WINDOWS\system32\wmpns.dll 2006-11-23 13:00 d——– C:\Program Files\Windows Media Connect 2 2006-11-23 12:53 d——– C:\WINDOWS\system32\drivers\UMDF 2006-11-23 12:50 d–hs—- C:\Config.Msi 2006-11-23 11:39 d——– C:\Documents and Settings\TCS\Application Data\DivX 2006-11-22 20:42 d——– C:\Program Files\Registry Mechanic 2006-11-22 08:16 56,832 –a—— C:\WINDOWS\system32\cpmrotate.dll 2006-11-18 21:41 152,360 –a—— C:\WINDOWS\system32\msnxplpi3.dll 2006-11-17 22:28 d——– C:\WINDOWS\Sun 2006-11-17 22:28 d——– C:\Documents and Settings\TCS\Application Data\Sun 2006-11-16 21:04 245,760 –a—— C:\WINDOWS\system32\rlxf.dll 2006-11-16 20:59 8,464 –a—— C:\WINDOWS\system32\sporder.dll 2006-11-16 20:59 299,008 –a—— C:\WINDOWS\system32\rlls.dll 2006-11-16 20:59 d——– C:\Documents and Settings\TCS\Application Data\LimeWire 2006-11-16 20:57 d——– C:\Program Files\Java 2006-11-16 20:56 d——– C:\Program Files\Common Files\Java 2006-11-16 19:39 151,848 –a—— C:\WINDOWS\system32\msnxcli2.dll 2006-11-16 19:39 10 –a—— C:\WINDOWS\system32\m96pk.dll 2006-11-14 00:03 39,749 –a—— C:\WINDOWS\system32\cpmrot-uninst.exe 2006-11-14 00:00 d——– C:\Documents and Settings\TCS\Application Data\InterVideo 2006-11-13 23:01 d——– C:\Program Files\iTunes 2006-11-13 23:01 d——– C:\Program Files\iPod 2006-11-13 23:01 d——– C:\Documents and Settings\TCS\Application Data\Apple Computer 2006-11-13 23:00 d——– C:\Program Files\QuickTime 2006-11-13 22:59 d——– C:\Documents and Settings\All Users\Application Data\Apple Computer 2006-11-13 21:13 d——– C:\Program Files\AviSynth 2.5 2006-11-12 18:40 51,072 –a—— C:\WINDOWS\system32\drivers\ikhlayer.sys 2006-11-12 18:40 30,592 –a—— C:\WINDOWS\system32\drivers\ikhfile.sys 2006-11-12 18:39 d——– C:\Program Files\Spyware Doctor 2006-11-12 18:39 d——– C:\Documents and Settings\TCS\Application Data\PC Tools 2006-11-12 10:41 dr-h—– C:\Documents and Settings\TCS\Application Data\yahoo! 2006-11-12 09:52 d——– C:\Documents and Settings\All Users\Application Data\yahoo! 2006-11-12 09:28 d——– C:\Program Files\Symantec Technical Support 2006-11-11 19:30 d——– C:\Program Files\Yahoo! 2006-11-11 12:58 7 –a—— C:\WINDOWS\system32\wl5841.vbs 2006-11-11 09:52 50,688 –a—— C:\WINDOWS\system32\Inaz4618.dll 2006-11-11 09:52 d——– C:\WINDOWS\i386 2006-11-11 08:45 d——– C:\WINDOWS\IBM 2006-11-11 05:05 d——– C:\WINDOWS\system32\LogFiles 2006-11-10 22:23 d——– C:\Vinod 2006-11-04 14:14 1,245,696 –a—— C:\WINDOWS\system32\msxml4.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-25 08:36 ——– d——– C:\Program Files\Symantec AntiVirus 2006-11-25 08:25 ——– d——– C:\Program Files\Windows Media Player 2006-11-25 08:03 ——– d——– C:\Program Files\Internet Explorer 2006-11-25 08:01 ——– d——– C:\Program Files\Outlook Express 2006-11-25 08:01 ——– d——– C:\Program Files\Common Files\System 2006-11-23 12:51 ——– d——– C:\Program Files\Windows Media Connect 2006-11-18 10:37 69632 –a—— C:\Documents and Settings\TCS\Application Data\internaldb4827.dat 2006-11-18 10:24 379 –a—— C:\Documents and Settings\TCS\Application Data\internaldb1942.dat 2006-11-18 10:23 49 –a—— C:\Documents and Settings\TCS\Application Data\internaldb41.dat 2006-11-18 09:56 151 –a—— C:\Documents and Settings\TCS\Application Data\internaldb6500.dat 2006-11-18 09:56 0 –a—— C:\Documents and Settings\TCS\Application Data\internaldb2391.dat 2006-11-18 07:20 0 –a—— C:\Documents and Settings\TCS\Application Data\internaldb5436.dat 2006-11-17 23:42 ——– d——– C:\Program Files\Microsoft AntiSpyware 2006-11-16 20:59 ——– d—s—- C:\Documents and Settings\TCS\Application Data\Microsoft 2006-11-16 20:56 ——– d——– C:\Program Files\Common Files 2006-11-16 04:51 0 –a—— C:\Documents and Settings\TCS\Application Data\internaldb3902.dat 2006-11-14 00:03 9216 –a—— C:\Documents and Settings\TCS\Application Data\internaldb8467.dat 2006-11-14 00:03 23 –a—— C:\Documents and Settings\TCS\Application Data\inifile41.ini 2006-11-14 00:03 0 –a—— C:\Documents and Settings\TCS\Application Data\internaldb6334.dat 2006-11-14 00:03 0 –a—— C:\Documents and Settings\TCS\Application Data\internaldb4604.dat 2006-11-14 00:03 0 –a—— C:\Documents and Settings\TCS\Application Data\internaldb153.dat 2006-11-11 09:52 1032192 –a—— C:\WINDOWS\explorer.exe 2006-10-18 21:58 8704 –a—— C:\WINDOWS\system32\wdfmgr.exe 2006-10-18 21:58 8704 –a—— C:\WINDOWS\system32\uwdf.exe 2006-10-18 21:47 99840 –a—— C:\WINDOWS\system32\wmpshell.dll 2006-10-18 21:47 991744 –a—— C:\WINDOWS\system32\drmv2clt.dll 2006-10-18 21:47 937984 –a—— C:\WINDOWS\system32\WMNetMgr.dll 2006-10-18 21:47 8231936 –a—— C:\WINDOWS\system32\wmploc.dll 2006-10-18 21:47 767488 ——— C:\WINDOWS\system32\WMVSENCD.dll 2006-10-18 21:47 757248 –a—— C:\WINDOWS\system32\WMADMOD.dll 2006-10-18 21:47 7168 –a—— C:\WINDOWS\system32\asferror.dll 2006-10-18 21:47 656896 ——— C:\WINDOWS\system32\WMVXENCD.dll 2006-10-18 21:47 63488 –a—— C:\WINDOWS\system32\wpdmtpus.dll 2006-10-18 21:47 629760 –a—— C:\WINDOWS\system32\wpd_ci.dll 2006-10-18 21:47 613376 ——— C:\WINDOWS\system32\wmpmde.dll 2006-10-18 21:47 603648 –a—— C:\WINDOWS\system32\WMSPDMOD.dll 2006-10-18 21:47 542720 –a—— C:\WINDOWS\system32\blackbox.dll 2006-10-18 21:47 535040 ——— C:\WINDOWS\system32\wmdrmsdk.dll 2006-10-18 21:47 429056 –a—— C:\WINDOWS\system32\wmdrmdev.dll 2006-10-18 21:47 414208 –a—— C:\WINDOWS\system32\msscp.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmvdmoe2.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmvdmod.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\WMVADVE.DLL 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\WMVADVD.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmsdmoe2.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmsdmod.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wdfapi.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\MPG4DMOD.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\MP4SDMOD.dll 2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\mp43dmod.dll 2006-10-18 21:47 38400 ——— C:\WINDOWS\system32\wpdshextres.dll 2006-10-18 21:47 37376 –a—— C:\WINDOWS\system32\wmdmps.dll 2006-10-18 21:47 35840 –a—— C:\WINDOWS\system32\wpdconns.dll 2006-10-18 21:47 356352 –a—— C:\WINDOWS\system32\wpdsp.dll 2006-10-18 21:47 348672 –a—— C:\WINDOWS\system32\wmdrmnet.dll 2006-10-18 21:47 33792 –a—— C:\WINDOWS\system32\wmdmlog.dll 2006-10-18 21:47 321536 –a—— C:\WINDOWS\system32\mswmdm.dll 2006-10-18 21:47 317440 ——— C:\WINDOWS\system32\MP4SDECD.dll 2006-10-18 21:47 314880 –a—— C:\WINDOWS\system32\wmpdxm.dll 2006-10-18 21:47 295936 ——— C:\WINDOWS\system32\wmpeffects.dll 2006-10-18 21:47 284160 ——— C:\WINDOWS\system32\PortableDeviceApi.dll 2006-10-18 21:47 276992 –a—— C:\WINDOWS\system32\audiodev.dll 2006-10-18 21:47 27136 –a—— C:\WINDOWS\system32\mspmsnsv.dll 2006-10-18 21:47 2603008 ——— C:\WINDOWS\system32\WpdShext.dll 2006-10-18 21:47 259072 ——— C:\WINDOWS\system32\MPG4DECD.dll 2006-10-18 21:47 259072 ——— C:\WINDOWS\system32\MP43DECD.dll 2006-10-18 21:47 2450944 –a—— C:\WINDOWS\system32\wmvcore.dll 2006-10-18 21:47 242688 –a—— C:\WINDOWS\system32\wmpasf.dll 2006-10-18 21:47 229376 –a—— C:\WINDOWS\system32\cewmdm.dll 2006-10-18 21:47 227328 –a—— C:\WINDOWS\system32\wmerror.dll 2006-10-18 21:47 222208 –a—— C:\WINDOWS\system32\wmasf.dll 2006-10-18 21:47 212992 ——— C:\WINDOWS\system32\MFPLAT.dll 2006-10-18 21:47 204288 –a—— C:\WINDOWS\system32\wmpsrcwp.dll 2006-10-18 21:47 199168 ——— C:\WINDOWS\system32\PortableDeviceWMDRM.dll 2006-10-18 21:47 179712 –a—— C:\WINDOWS\system32\msnetobj.dll 2006-10-18 21:47 175616 –a—— C:\WINDOWS\system32\mspmsp.dll 2006-10-18 21:47 166912 ——— C:\WINDOWS\system32\PortableDeviceTypes.dll 2006-10-18 21:47 1661440 –a—— C:\WINDOWS\system32\wmpencen.dll 2006-10-18 21:47 1574912 ——— C:\WINDOWS\system32\WMVENCOD.dll 2006-10-18 21:47 157184 –a—— C:\WINDOWS\system32\wmidx.dll 2006-10-18 21:47 154624 –a—— C:\WINDOWS\system32\wpdmtp.dll 2006-10-18 21:47 1543680 ——— C:\WINDOWS\system32\WMVDECOD.dll 2006-10-18 21:47 1382912 ——— C:\WINDOWS\system32\WMVSDECD.dll 2006-10-18 21:47 133632 ——— C:\WINDOWS\system32\WPDShServiceObj.dll 2006-10-18 21:47 1329152 –a—— C:\WINDOWS\system32\WMSPDMOE.dll 2006-10-18 21:47 132096 ——— C:\WINDOWS\system32\PortableDeviceWiaCompat.dll 2006-10-18 21:47 130048 ——— C:\WINDOWS\system32\wmpps.dll 2006-10-18 21:47 11264 –a—— C:\WINDOWS\system32\LAPRXY.dll 2006-10-18 21:47 1117696 –a—— C:\WINDOWS\system32\WMADMOE.dll 2006-10-18 21:47 101888 ——— C:\WINDOWS\system32\PortableDeviceClassExtension.dll 2006-10-18 20:03 100864 –a—— C:\WINDOWS\system32\logagent.exe 2006-10-18 20:00 38528 –a—— C:\WINDOWS\system32\drivers\wpdusb.sys 2006-10-18 20:00 249856 ——— C:\WINDOWS\system32\drmupgds.exe 2006-10-18 20:00 17408 ——— C:\WINDOWS\system32\wpdshextautoplay.exe 2006-10-13 07:35 65536 –a—— C:\WINDOWS\system32\nwwks.dll 2006-10-13 07:35 64000 –a—— C:\WINDOWS\system32\nwapi32.dll 2006-10-13 07:35 142336 –a—— C:\WINDOWS\system32\nwprovau.dll 2006-10-13 05:23 163584 –a—— C:\WINDOWS\system32\drivers\nwrdr.sys 2006-10-02 15:28 312128 ——— C:\WINDOWS\system32\msdelta.dll 2006-09-28 20:13 95344 ——— C:\WINDOWS\system32\WUDFCoinstaller.dll 2006-09-28 19:00 82944 ——— C:\WINDOWS\system32\drivers\WudfRd.sys 2006-09-28 18:56 55808 ——— C:\WINDOWS\system32\WudfSvc.dll 2006-09-28 18:56 316416 ——— C:\WINDOWS\system32\WUDFx.dll 2006-09-28 18:56 165376 ——— C:\WINDOWS\system32\WudfPlatform.dll 2006-09-28 18:56 146432 ——— C:\WINDOWS\system32\WudfHost.exe 2006-09-28 18:55 77568 ——— C:\WINDOWS\system32\drivers\WudfPf.sys 2006-09-25 17:58 23856 –a—— C:\WINDOWS\system32\spupdsvc.exe 2006-09-19 15:43 109360 –a—— C:\WINDOWS\system32\GEARAspi.dll 2006-09-13 00:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll 2006-08-25 10:45 617472 –a—— C:\WINDOWS\system32\comctl32.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "ibmmessages"="C:\\Program Files\\IBM\\Messages By IBM\\ibmmessages.exe" "NetSP - restore settings on power failure"="\"C:\\Program Files\\AT&T Global Network Client\\NetSP.exe\" -show" "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "TPKMAPHELPER"="C:\\Program Files\\ThinkPad\\Utilities\\TpKmapAp.exe -helper" "TpShocks"="TpShocks.exe" "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "ControlCenter"="\"C:\\Program Files\\ThinkVantage Fingerprint Software\\ctlcntr.exe\" /startup" "TP4EX"="tp4ex.exe" "EZEJMNAP"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.Exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "UC_Start"="C:\\Program Files\\IBM\\Updater\\\\ucstartup.exe" "UC_SMB"="" "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe" @="" "IBMPRC"="C:\\IBMTOOLS\\UTILS\\ibmprc.exe" "QCTRAY"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCTRAY.EXE" "QCWLICON"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCWLICON.EXE" "PWRMGRTR"="rundll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\PWRMGRTR.DLL,PwrMgrBkGndMonitor" "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "ibmmessages"="C:\\Program Files\\IBM\\Messages By IBM\\ibmmessages.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" "RegistryMechanic"="" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "del"="del c:\\winstall.exe" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,03,00,00,e4,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "Wallpaper"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoActiveDesktop"=dword:00000000 "ClassicShell"=dword:00000000 "ForceActiveDesktopOn"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\PMTask.job Completion time: 06-11-25 13:44:30.17 C:\ComboFix.txt … 06-11-25 13:44 ==================================== Thanks Vinod

Run this online scan and post the results here.
http://www.pandasoftware.com/products/ActiveScan.htm

Dear Little Eagle, Please find the log after running Pandasoftware Incident Status Location Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@2o7[2].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\TCS\Cookies\[removed][2].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@adrevolver[2].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@adrevolver[3].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\TCS\Cookies\[removed][1].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@advertising[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@atdmt[2].txt Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@bluestreak[2].txt Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@ccbill[1].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@com[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@doubleclick[1].txt Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@fortunecity[2].txt Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@hitbox[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@mediaplex[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@questionmarket[2].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@realmedia[1].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\TCS\Cookies\[removed][1].txt Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\TCS\Cookies\[removed][1].txt Spyware:Cookie/Target Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@target[2].txt Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@trafficmp[2].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\TCS\Cookies\tcs@tribalfusion[1].txt Virus:Trj/Downloader.LJW Disinfected C:\WINDOWS\system32\msnxcli2.dll Adware:Adware/Brands Not disinfected C:\WINDOWS\system32\msnxplpi3.dll Thanks for your timely help. Vinod

Download The Avenger Copyright © Swandog46
You must extract avenger.exe to your desktop, before you run it.
The Avenger must be run from a user account with administrator privileges,
and ONLY works on Windows 2000 and XP, and only on 32-bit versions!

Copy all the text contained in the code box below to your Clipboard.

Files to delete:
C:\WINDOWS\system32\msnxcli2.dll
C:\WINDOWS\system32\msnxplpi3.dll

The above script is for this user only, if you need help please start your own thread.

Start the Avenger.
Under "Script file to execute" choose "Input Script Manually".
Click on the Magnifying Glass icon which will open a new window titled "View/edit script".
Paste the entire text in into this window.
Click done, now click on the Green Light
Answer "Yes" twice when prompted.
Your computer shoud reboot, and briefly open a black command window on your desktop, this is normal.

After the restart, it will create a log file that should open.
This log file will be located at C:\avenger.txt
Paste the contents of the file into your reply along with a fresh HJT log.

Also: Avenger has made backups of all the files, etc., that you asked it to delete, located at C:\avenger\backup.zip.

Dear Little Eagle, Here is the log. I guess it didn't process. Please let me know if there is anything wrong I did. My is a Windows XP PC. Please help me as I have to go to work on Monday. It would be really painful. Thanks again Vinod ================================================= Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\koroyahc ******************* Script file located at: \??\C:\WINDOWS\system32\krbwvbxb.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\msnxcli2.dll not found! Deletion of file C:\WINDOWS\system32\msnxcli2.dll failed! Could not process line: C:\WINDOWS\system32\msnxcli2.dll Status: 0xc0000034 File C:\WINDOWS\system32\msnxplpi3.dll not found! Deletion of file C:\WINDOWS\system32\msnxplpi3.dll failed! Could not process line: C:\WINDOWS\system32\msnxplpi3.dll Status: 0xc0000034 =================================================

Rescan with HJT and post a new log here. Also please describe how your computer behaves at the moment.