Regedit closes seconds after opening

Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1 File to upload & scan: Service Service load: 0% 100% File: mirar_distro_876260.exe Status: OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 7d2a5bb777629f200f2d7f488ce0e32c Packers detected: - Scanner results Scan taken on 12 Feb 2007 12:41:03 (GMT) AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing VirusBuster Found nothing VBA32 Found nothing Powered by Disclaimer This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service. Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita. Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware. Virus definitions are updated every hour. There is a 15Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample. Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all. Sponsored by donations (in random order) from: Stormbyte Technologies LLC, The ClamAV project, Steve S., Eric Johansen, Eric Schechter, Paul Bokel, Wilders Security, Wilfried Lilie, Prevx, SonicWALL, Lance Mueller, Ewido networks, HotelScraper.com, people who donated in the past, and some people who prefer to remain anonymous… many thanks to all! Statistics Last file scanned at least one scanner reported something about: 07209.exe (MD5: d6432741a48f5efd0167e4ece9760fe0), detected by: Scanner Malware name AntiVir BDS/Hupigon.Gen backdoor ArcaVir X Avast Win32:Hupigon-JF AVG Antivirus BackDoor.Generic4.VGB BitDefender Generic.Graybird.C1C6D7BC ClamAV X Dr.Web BackDoor.Pigeon.680 F-Prot Antivirus X F-Secure Anti-Virus X Fortinet X Kaspersky Anti-Virus X NOD32 a variant of Win32/Hupigon Norman Virus Control X VirusBuster X VBA32 MalwareScope.Backdoor.Hupigon.3 You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives We are not affiliated with any third parties that conduct tests using this service. Frequently asked questions - Feedback - Privacy policy Page generated by JTPL Copyright © 2004-2007 Jordi Bosveld <[removed]>

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT 07-02-12 12:08 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 12/02/2007 Kaspersky Anti-Virus database records: 252075 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ T:\ Scan Statistics: Total number of scanned objects: 146442 Number of viruses found: 2 Number of infected objects: 14 / 0 Number of suspicious objects: 0 Duration of the scan process: 02:56:10 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\4631557A.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped C:\Documents and Settings\jtyo.ABC\Cookies\index.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\jtyo.ABC\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC\Local Settings\History\History.IE5\MSHist012007021220070213\index.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst/Archive Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst/Archive Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst/Archive Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst Mail MS Mail: infected - 3 skipped C:\Documents and Settings\jtyo.ABC\NTUSER.DAT Object is locked skipped C:\Documents and Settings\jtyo.ABC\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\D4\SyncHistory.dat Object is locked skipped C:\Program Files\D4\SyncHistoryServers.dat Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{13FE0EB9-9ED1-48F9-82F4-E83B391001ED}\RP13\change.log Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\browser.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\cmdevtgprov.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\evtgprov.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\Netlogon.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped E:\My Documents\James.zip/James.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped E:\My Documents\James.zip/James.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped E:\My Documents\James.zip/James.pst/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped E:\My Documents\James.zip/James.pst Infected: Virus.Win32.Weird.10240 skipped E:\My Documents\James.zip ZIP: infected - 4 skipped F:\My Documents\James.zip/James.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped F:\My Documents\James.zip/James.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped F:\My Documents\James.zip/James.pst/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped F:\My Documents\James.zip/James.pst Infected: Virus.Win32.Weird.10240 skipped F:\My Documents\James.zip ZIP: infected - 4 skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed.

Kapersky only found infected emails that are still present on your system.

You may need to compact the files in order to delete them.
http://support.microsoft.com/kb/289987/
How to Manually Start PST Compaction

• On the File menu, click Data File Management.
• Click to select your Personal Folder, and then click Settings.
• On the General tab, click Compact Now.
• Click OK, and then click Close.

How to Manually Start OST Compaction

• On the Tools menu, click to select E-mail Accounts.
• Click View or change existing e-mail account, and then click Next.
• Click Microsoft Exchange Server, and then click Change.
• Click More Settings.
• On the Advanced tab, click Offline Folder File Settings.
• Click Compact Now.
• When the compact operation is finished, click OK twice.
• Click Next, and then click Finish.

It appears that you have infected emails in
C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst
E:\My Documents\James.zip/James.pst/Personal Folders/Inbox/
F:\My Documents\James.zip/James.pst/Personal Folders/

Please try to delete the infected emails.
C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst/Archive Folders/Sent
Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped
C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst/Archive Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped
C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst/Archive Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped
C:\Documents and Settings\jtyo.ABC\My Documents\D$\Archive\archive.pst Mail MS Mail: infected - 3 skipped
E:\My Documents\James.zip/James.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped
E:\My Documents\James.zip/James.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped
E:\My Documents\James.zip/James.pst/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped
E:\My Documents\James.zip/James.pst Infected: Virus.Win32.Weird.10240 skipped
E:\My Documents\James.zip ZIP: infected - 4 skipped
F:\My Documents\James.zip/James.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped
F:\My Documents\James.zip/James.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped
F:\My Documents\James.zip/James.pst/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped
F:\My Documents\James.zip/James.pst Infected: Virus.Win32.Weird.10240 skipped
F:\My Documents\James.zip ZIP: infected - 4 skipped

Please run Kapersky again and verify that you deleted them. Please then post (reply) with Kapersky.

WARNING-Combofix

Please Do Not use Combofix and delete Combofix from your computer!

Malware has recently been created and identified that will cause ComboFix to delete normal files and adversely affect your computer.

• If you have run ComboFix in the past and did not suffer any adverse affects do not worry, but please delete ComboFix now.
• You must have the specific malware infection present on your system to cause ComboFix to delete the normal files, but as safety precaution you need to delete ComboFix now!

Have you abandoned the log? I noticied that you are online now.

i successfully removed combofix

Were you able to delete those emails and run Kapersky again and obtain a clean scan?

i was able to successfully remove the email… i am in process as time allows to run kaspersky

Please post (reply) with one more hijackthis log. I will give you the final instructions but want to see log first since it has been awhile. If you should run Kapersky in future and have infected files, you can always start a new thread.

Just a minor fix for hijackthis-eliminating a do-nothing entry.

Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
• Click on Tools, General Settings.
• Under Real-time protection options, unselect the Turn on real-time protection check box
• Click Save

Scan with HijackThis. Place a check against each of the following:
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

After all of the fixes are complete it is very important that you enable Real-time Protection again.

======
System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

• Turn off System Restore.
• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Reboot.

Turn ON System Restore.

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check *Turn off System Restore*.
• Click Apply, and then click OK.

======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  A tutorial on installing & using this product can be found here:
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  A tutorial on installing & using this product can be found here:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
  
  
• More info on how to prevent malware you can also find here (By Tony Klein)

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Thursday, March 15, 2007 4:26:46 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 15/03/2007 Kaspersky Anti-Virus database records: 266121 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - Folders: C:\ Scan Statistics: Total number of scanned objects: 60101 Number of viruses found: 2 Number of infected objects: 10 / 0 Number of suspicious objects: 0 Duration of the scan process: 01:46:24 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-12062006-152233.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\3DF11179.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\4F131733.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Application Data\Microsoft\Outlook\Outlook.srs Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Cookies\index.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Application Data\AOL OCP\AIM\Storage\data\ez4u2nv3\localStorage\common.cls Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Application Data\Microsoft\Outlook\Jamesoutlook.pst Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Application Data\Microsoft\Outlook\outlook.ost Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{0C9FF7B2-B9F3-4E3A-8DD1-C71F6E1DFC56} Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\History\History.IE5\MSHist012007031520070316\index.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Temp\ExchangePerflog_8484fa31155ffc81cfcccd43.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Temp\Perflib_Perfdata_94c.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Temp\~DFAA64.tmp Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Temp\~DFEC91.tmp Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Temp\~DFF7D3.tmp Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Temp\~WRF0001.tmp Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Temp\~WRS0002.tmp Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\NTUSER.DAT Object is locked skipped C:\Documents and Settings\jtyo.ABC.000\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\D4\SyncHistory.dat Object is locked skipped C:\Program Files\D4\SyncHistoryServers.dat Object is locked skipped C:\Program Files\LogMeIn Rescue\LMIRescue-3438843.clog Object is locked skipped C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PALMAPP.DOT Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\billing_jtyo.log Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\client_jtyo.log Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\network_jtyo.log Object is locked skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc3.pst/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc3.pst Mail MS Mail: infected - 1 skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc5.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc5.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc5.pst/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc5.pst Mail MS Mail: infected - 3 skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc6.bak/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc6.bak/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc6.bak/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc6.bak Mail MS Mail: infected - 3 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{13FE0EB9-9ED1-48F9-82F4-E83B391001ED}\RP54\change.log Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\browser.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\cmdevtgprov.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\evtgprov.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\Netlogon.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Good work! All you have to do now is empty that Recycle Bin! Then your scan should be clean!

Scan Statistics:
Total number of scanned objects: 60101
Number of viruses found: 2
Number of infected objects: 10 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:46:24

Infected Object Name / Virus Name / Last Action

C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc3.pst/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc3.pst Mail MS Mail: infected - 1 skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc5.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc5.pst/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc5.pst/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc5.pst Mail MS Mail: infected - 3 skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc6.bak/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.html Infected: Trojan-Spy.HTML.Bankfraud.w skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc6.bak/Personal Folders/Inbox/14 Dec 2004 17:02 from Washington Mutual:Washington Mutual: Impo.rtf Infected: Trojan-Spy.HTML.Bankfraud.w skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc6.bak/Personal Folders/Sent Items/10 Sep 2002 15:45 to Penn, Christopher:.exe/DRTCP021.exe Infected: Virus.Win32.Weird.10240 skipped
C:\RECYCLER\S-1-5-21-57989841-1214440339-839522115-3200\Dc6.bak Mail MS Mail: infected - 3 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Hi Jamest765, Is everything fine now? Please let me know and I will close this thread.