Is there something wrong here?

hi Newby79,

I'm Gary R, I'll be glad to help you with your computer problems.

As an introduction, please note I don't know everything, what I do know has taken me years to learn and I'm happy to pass on this information to you, but bear in mind that I'm also fallible. I do have a very knowlegable group behind me who I can ask if needs be.

You have been infected with the AGOBOT/GAOBOT worm, and your computer is very likely being used to distribute spam. You have a backdoor/proxy trojan on your computer which gives the attacker complete access to your machine.

You are strongly advised to do the following immediately:

1. Disconnect infected computer from the internet and from any networked computers until the computer can be cleaned.

2. Call all of your banks, credit card companies, and financial institutions. Inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

3. From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer, because the attacker will get the new passords and transaction information.

IF YOU USE THIS COMPUTER FOR ONLINE BANKING OR OTHER FINANCIAL TRANSACTIONS, OR HAVE DATA OF A CONFIDENTIAL NATURE ON IT, MY RECOMMENDATION IS THAT YOU RE-FORMAT AND RE-INSTALL YOUR OPERATING SYSTEM AND PROGRAMMES. WE CAN NEVER BE TOTALLY SURE WE HAVE GOT RID OF ALL MODIFICATIONS WHICH MAY HAVE BEEN MADE BY THE ATTACKER, AND THEREFORE CANNOT GUARANTEE THE SAFETY OF YOUR DATA.

If you choose to re-format, instructions for doing so can be found HERE (courtesy of wng_z3r0).

If you choose not to re-format we can attempt to clean your computer, but we can give no guarantees that everything will be removed.

Let me know what you decide to do.

hi gary. thanks for the tips. this is actually my sisters computer, and by me trying to learn new things as well, i would like to try to clean it up by myself. anything you can teach me from this point would be greatly appreciated!

Hey Gary. I went step by step and did not find the following files:scvhost.exe C:\WINDOWS\web\related.htm C:\WINDOWS\System32\wincffg.exe C:\WINDOWS\System32\svchos1.exe These Folders C:\Program Files\7vs4ceb9 C:\Program Files\CSBB C:\Program Files\RXToolBar C:\Program Files\Napster C:\Program Files\WebSavingsfromEbates I ran spybot, avg and came up with no problems. I then ran the kaspersky and here are my results:

Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\42a0ffdb4a83c88c749edcf380cfdf55_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5776861cef8c7c9fdace70aea137d93b_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Megasearch.zip/MegasearchBarSetup.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Megasearch.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\Donald Smith\Local Settings\Temp\ncmyb.dll Infected: not-a-virus:AdWare.Win32.180Solutions skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Yana\Application Data\AVG7\l_000108.log Object is locked skipped C:\Documents and Settings\Yana\Application Data\GTek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped C:\Documents and Settings\Yana\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Yana\Desktop\hijackthis\backups\backup-20070131-214519-662.dll Infected: not-a-virus:AdWare.Win32.ClearSearch.y skipped C:\Documents and Settings\Yana\Desktop\hijackthis\backups\backup-20070131-214523-210.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped C:\Documents and Settings\Yana\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Yana\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Temp\~DF5F40.tmp Object is locked skipped C:\Documents and Settings\Yana\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Yana\ntuser.dat Object is locked skipped C:\Documents and Settings\Yana\ntuser.dat.LOG Object is locked skipped C:\Program Files\7vs4ceb9\1jiqdghb.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.al skipped C:\Program Files\7vs4ceb9\3pnhvghk.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.at skipped C:\Program Files\7vs4ceb9\4epir7rr.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.ab skipped C:\Program Files\7vs4ceb9\4znsmo7u.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.al skipped C:\Program Files\7vs4ceb9\6mtl64i1.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.t skipped C:\Program Files\7vs4ceb9\7qxq297g.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.ah skipped C:\Program Files\7vs4ceb9\7vs4ceb91\7vs4ceb91.dll Infected: not-a-virus:AdWare.Win32.ClearSearch.z skipped C:\Program Files\7vs4ceb9\7vs4ceb91\7vs4ceb91.exe Infected: not-a-virus:AdWare.Win32.ClearSearch.ac skipped C:\Program Files\7vs4ceb9\akfmdy2p.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.ae skipped C:\Program Files\7vs4ceb9\d6vb7omm.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.al skipped C:\Program Files\7vs4ceb9\d8loj0b7.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.al skipped C:\Program Files\7vs4ceb9\kpikpknz.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.ah skipped C:\Program Files\7vs4ceb9\pyiqu4yh.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.al skipped C:\Program Files\7vs4ceb9\qmq7qqkc.DLL Infected: Backdoor.Win32.Ruledor.i skipped C:\Program Files\7vs4ceb9\rbrlu2rk.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.ar skipped C:\Program Files\7vs4ceb9\syzsmzpx.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.al skipped C:\Program Files\7vs4ceb9\vp2fggao.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.w skipped C:\Program Files\7vs4ceb9\z2y3dlmf.DLL Infected: not-a-virus:AdWare.Win32.ClearSearch.t skipped C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped C:\Program Files\SBC Self Support Tool\log\mpbtn.log Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050320162420.zip/WINDOWS/downloaded program files/SAHAgent_.exe Infected: not-a-virus:AdWare.Win32.Sahat.c skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050320162420.zip/WINDOWS/downloaded program files/SahHtml_.exe Infected: not-a-virus:AdWare.Win32.Sahat.c skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050320162420.zip/WINDOWS/system32/SahAgent.exe Infected: not-a-virus:AdWare.Win32.Sahat.c skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050320162420.zip/WINDOWS/system32/sahagent1019.exe/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.a skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050320162420.zip/WINDOWS/system32/sahagent1019.exe Infected: not-a-virus:AdWare.Win32.Sahat.a skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050320162420.zip/WINDOWS/system32/SahHtml.exe Infected: not-a-virus:AdWare.Win32.Sahat.c skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050320162420.zip/WINDOWS/system32/drivers/etc/hosts Infected: Trojan.Win32.Qhost skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050320162420.zip ZIP: infected - 7 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050907132145.zip/WINDOWS/systb.exe/systb.dll Infected: not-a-virus:AdWare.Win32.ImiBar.d skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050907132145.zip/WINDOWS/systb.exe Infected: not-a-virus:AdWare.Win32.ImiBar.d skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050907132145.zip/WINDOWS/system32/drivers/etc/hosts Infected: Trojan.Win32.Qhost skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050907132145.zip ZIP: infected - 3 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050907132146.zip/WINDOWS/system32/drivers/etc/hosts Infected: Trojan.Win32.Qhost skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050907132146.zip ZIP: infected - 1 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050907181344.zip Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050911235408.zip/WINDOWS/system32/drivers/etc/hosts Infected: Trojan.Win32.Qhost skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20050911235408.zip ZIP: infected - 1 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\20051005033438.zip Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq10.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq104.tmp Infected: not-a-virus:AdWare.Win32.180Solutions skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq11.tmp Infected: not-a-virus:AdWare.Win32.BargainBuddy.n skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq11E.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq12.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq120.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq14.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15B.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15C.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15D.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15E.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15F.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq160.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq161.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq162.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq163.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq164.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Ap350\ebmm350.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Ap350\merc351.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Ap350\mercexcleb.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Ap350\psid385.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Ap350\psid390.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Da350\350sh.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Da350\4143231f7561.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Da350\414323224cf.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Da350\administrator\4143238f35bc.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\README.txt Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm.ico Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_button_clickhere.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_button_getcashbck.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_button_no.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_button_submit.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_button_yes.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_clear.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_cou_button_savenow.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_cou_logo_greenbground.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_cou_moe.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_cou_moe_logo.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_hot.ico Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_logo1.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_logo_topmox.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_moe_question.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_moe_reminder.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_moe_top.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_moe_with_cash.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\ebmm_spacer.gif Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Images\logtime.log Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Sy350\350_0.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Sy350\350_1.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Sy350\350_2.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\log.txt Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\popo350a_counv.htm Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\popo350a_couyv.htm Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\popo350a_non.htm Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\popo350a_nv.htm Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\pref350a.htm Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\pref350a_dis.htm Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\scri350a.htm Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq165.tmp\Sy350\Tp350\spec350a_yv.htm Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq167.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq168.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq16B.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq17D.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq184.tmp\Instr\33.xml Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq186.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq188.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18A.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18C.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\ad.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\adp8034.exe Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\bin\nls.exe Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\nls8036.exe Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1110774453.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1111379415.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1113271520.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1114361789.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1118462112.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1119729372.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1120017732.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1122345081.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1123453878.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1124414687.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1124853868.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\t1125159563.dec Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\ub.dat Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp\Uninstall.exe Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18F.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq191.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq197.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq27.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2B.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2D.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq32.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq34.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq44.tmp Infected: Trojan-Clicker.Win32.Delf.r skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4C.tmp Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq53.tmp Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq54.tmp Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq55.tmp Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq56.tmp Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq60.tmp/cd_clint.dll Infected: not-a-virus:AdWare.Win32.Cydoor skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq60.tmp/cd_htm.dll Infected: not-a-virus:AdWare.Win32.Cydoor skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq60.tmp ZIP: infected - 2 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq67.tmp Infected: not-a-virus:AdWare.Win32.Gator.4116 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq69.tmp\DateManager.exe Infected: not-a-virus:AdWare.Win32.Gator.4116 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6B.tmp Infected: not-a-virus:AdWare.Win32.WebRebates.d skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqAB.tmp Infected: not-a-virus:AdWare.Win32.BargainBuddy.q skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB4.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC6.tmp Infected: not-a-virus:AdWare.Win32.Gator.2102 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCB.tmp\PrecisionTime.exe Infected: not-a-virus:AdWare.Win32.Gator.2102 skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD3.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE2.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE4.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE6.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE8.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqEA.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqEC.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF2.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF8.tmp Object is locked skipped C:\Program Files\Yahoo!\YPSR\Quarantine\ppqsdb.dat Object is locked skipped C:\System Volume Information\catalog.wci\00000002.ps1 Object is locked skipped C:\System Volume Information\catalog.wci\00000002.ps2 Object is locked skipped C:\System Volume Information\catalog.wci\00010001.ci Object is locked skipped C:\System Volume Information\catalog.wci\cicat.fid Object is locked skipped C:\System Volume Information\catalog.wci\cicat.hsh Object is locked skipped C:\System Volume Information\catalog.wci\CiCL0001.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiP10000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiP20000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiPT0000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiSL0001.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiSP0000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiST0000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiVP0000.000 Object is locked skipped C:\System Volume Information\catalog.wci\INDEX.000 Object is locked skipped C:\System Volume Information\catalog.wci\propstor.bk1 Object is locked skipped C:\System Volume Information\catalog.wci\propstor.bk2 Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\_000013_.tmp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\Debug\oakley.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Downloaded Program Files\HDPlugin1015.dll Infected: not-a-virus:AdWare.Win32.Gator.1015 skipped C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped C:\WINDOWS\mmaker2.exe/data0003 Infected: not-a-virus:AdWare.Win32.WebRebates.f skipped C:\WINDOWS\mmaker2.exe/data0004 Infected: not-a-virus:AdWare.Win32.WebRebates.d skipped C:\WINDOWS\mmaker2.exe/data0005 Infected: not-a-virus:AdWare.Win32.WebRebates.c skipped C:\WINDOWS\mmaker2.exe NSIS: infected - 3 skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{4542AF91-ACF0-481C-9463-587AAD536005}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\0021-bdl94126.EXE/WISE0007.BIN Infected: Trojan-Downloader.Win32.VB.ca skipped C:\WINDOWS\SYSTEM32\0021-bdl94126.EXE/WISE0008.BIN Infected: Trojan.Win32.Revop.c skipped C:\WINDOWS\SYSTEM32\0021-bdl94126.EXE WiseSFX: infected - 2 skipped C:\WINDOWS\SYSTEM32\BO2802040113.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d skipped C:\WINDOWS\SYSTEM32\BO2812040510.exe Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OT2JQP0H\WksPatch[1].exe Infected: Net-Worm.Win32.Welchia.b skipped C:\WINDOWS\SYSTEM32\ezNewS5.exe Infected: not-a-virus:AdWare.Win32.EZula.m skipped C:\WINDOWS\SYSTEM32\ezStub3.dll Infected: not-a-virus:AdWare.Win32.EZula.m skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\KVIF_11.dll Infected: not-a-virus:AdWare.Win32.EZula.t skipped C:\WINDOWS\SYSTEM32\KVIF_11.exe Infected: not-a-virus:AdWare.Win32.EZula.t skipped C:\WINDOWS\SYSTEM32\Lycos.dll/data0004 Infected: not-a-virus:AdWare.Win32.Sidesearch.b skipped C:\WINDOWS\SYSTEM32\Lycos.dll NSIS: infected - 1 skipped C:\WINDOWS\SYSTEM32\Lycos.dll Exe2Dll: infected - 1 skipped C:\WINDOWS\SYSTEM32\Lycos.dll UPX: infected - 1 skipped C:\WINDOWS\SYSTEM32\MegasearchBarSetup.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.n skipped C:\WINDOWS\SYSTEM32\msbb321.dll Infected: not-a-virus:AdWare.Win32.180Solutions skipped C:\WINDOWS\SYSTEM32\ss_msi1_setup.exe/data0004 Infected: not-a-virus:AdWare.Win32.Sidesearch.b skipped C:\WINDOWS\SYSTEM32\ss_msi1_setup.exe NSIS: infected - 1 skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped

here is my new hjt log:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Yana\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://att.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163557976171
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_1_5_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{96A5DB0F-3BCE-4E32-83AB-1A42367B7835}: NameServer = 68.94.156.1 68.94.157.1
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe

OK looking better, but still some work to do.

Download Pocket Killbox and install it to your Desktop. Do not run it yet.

• First copy the filepaths in the box below to your clipboard, by highlighting them and pressing Ctrl+C.

C:\WINDOWS\System32\scvhost.exe
C:\WINDOWS\web\related.htm
C:\WINDOWS\System32\wincffg.exe
C:\WINDOWS\System32\svchos1.exe
C:\Documents and Settings\Donald Smith\Local Settings\Temp\ncmyb.dll
C:\Documents and Settings\Yana\Local Settings\Temp\~DF5F40.tmp
C:\Program Files\7vs4ceb9\1jiqdghb.DLL
C:\Program Files\7vs4ceb9\3pnhvghk.DLL
C:\Program Files\7vs4ceb9\4epir7rr.DLL
C:\Program Files\7vs4ceb9\4znsmo7u.DLL
C:\Program Files\7vs4ceb9\6mtl64i1.DLL
C:\Program Files\7vs4ceb9\7qxq297g.DLL
C:\Program Files\7vs4ceb9\7vs4ceb91\7vs4ceb91.dll
C:\Program Files\7vs4ceb9\7vs4ceb91\7vs4ceb91.exe
C:\Program Files\7vs4ceb9\akfmdy2p.DLL
C:\Program Files\7vs4ceb9\d6vb7omm.DLL
C:\Program Files\7vs4ceb9\d8loj0b7.DLL
C:\Program Files\7vs4ceb9\kpikpknz.DLL
C:\Program Files\7vs4ceb9\pyiqu4yh.DLL
C:\Program Files\7vs4ceb9\qmq7qqkc.DLL
C:\Program Files\7vs4ceb9\rbrlu2rk.DLL
C:\Program Files\7vs4ceb9\syzsmzpx.DLL
C:\Program Files\7vs4ceb9\vp2fggao.DLL
C:\Program Files\7vs4ceb9\z2y3dlmf.DLL
C:\WINDOWS\Downloaded Program Files\HDPlugin1015.dll
C:\WINDOWS\Downloaded Program Files\popcaploader.dll
C:\WINDOWS\mmaker2.exe
C:\WINDOWS\SYSTEM32\0021-bdl94126.EXE
C:\WINDOWS\SYSTEM32\BO2802040113.dll
C:\WINDOWS\SYSTEM32\BO2812040510.exe
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OT2JQP0H\WksPatch[1].exe
C:\WINDOWS\SYSTEM32\ezNewS5.exe
C:\WINDOWS\SYSTEM32\ezStub3.dll
C:\WINDOWS\SYSTEM32\KVIF_11.dll
C:\WINDOWS\SYSTEM32\KVIF_11.exe
C:\WINDOWS\SYSTEM32\Lycos.dll
C:\WINDOWS\SYSTEM32\MegasearchBarSetup.dll
C:\WINDOWS\SYSTEM32\msbb321.dll
C:\WINDOWS\SYSTEM32\ss_msi1_setup.exe

• Open Killbox and check a mark in the "RadioBox" which says Delete On Reboot
• Click File > Paste from Clipboard.
• Click All Files button.
• Click on the Red button with a Cross, and answer Yes when prompted to Backup and Delete the pasted files.
• Answer Yes when prompted to Reboot now.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, download and run missingfilesetup.exe. Then try Killbox again.

Did you set Windows to display hidden files and folders before looking for the following folders, if not please follow the instructions given in my last post.
Then do a Manual search for the folders (do not use the search assistant). If found, delete the following folders.

C:\Program Files\7vs4ceb9
C:\Program Files\CSBB
C:\Program Files\RXToolBar
C:\Program Files\Napster
C:\Program Files\WebSavingsfromEbates


I don't expect them all to be there, but I do expect the 7vs4ceb9 folder to be there, as it is showing in the Kaspersky log.

Now can you run another Kaspersky scan and post me the resulting log, along with a new HJT log please.

Okay Gary, heres my hjt log. Sorry it took so long to get it to you, but like I told you, this is my sisters computer and I havent been over her house up until now. Hope this looks right to you. By the way, this computer is running so much faster now. Thanks so much!!


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Yana\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://att.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163557976171
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_1_5_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{96A5DB0F-3BCE-4E32-83AB-1A42367B7835}: NameServer = 68.94.156.1 68.94.157.1
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe

No problem, I'm not going anywhere. Can you send me the new Kaspersky scan log I asked for in my last post please.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php