Spyware / Malware / Virus Removal

Continuous Reboot

45 min read

Looking for the outcome? Ask AI

rkforan Topic Starter

Post #1May 19, 2007, 3:46 AM UTC

Help.

My daughter's computer continuously reboots. I started in safe mode and tried to restore to several prior dates to no avail. I then ran spy hunter and found it infected with multiple trojans. I removed them, but the rebooting continues when not in safe mode. Below is my hijackthis log. I got help from this site three years ago and you were able to get everything cleared up in a jiffy.

Thanks,
Kelly

Logfile of HijackThis v1.99.1
Scan saved at 10:26:27 PM, on 5/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILE…MPHUd1Fh+lrhA==
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll
O3 - Toolbar: OIN Search - {B9F6E8EB-A4E3-478E-88A4-D3995B5C45C8} - C:\Program Files\OIN Search\OINSearch.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [{C0725C08-0AE8-1033-0415-040101040001}] "C:\Program Files\Common Files\{C0725C08-0AE8-1033-0415-040101040001}\Update.exe" te-110-12-0000213
O4 - HKLM\..\Run: [{C0725C08-0AE9-1033-0415-040101040001}] "C:\Program Files\Common Files\{C0725C08-0AE9-1033-0415-040101040001}\Update.exe" te-110-12-0000213
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [hjenhdtA] C:\WINDOWS\hjenhdtA.exe
O4 - HKLM\..\Run: [win32077160-106624] C:\WINDOWS\win32077160-106624.exe
O4 - HKLM\..\Run: [{25-5C-C0-08-ZN}] C:\windows\system32\npdsregq.exe CHD001
O4 - HKLM\..\Run: [WindowsHive] C:\WINDOWS\system32\rpcc.exe
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\bak\mwsoemon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\winhealer.dll
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Unknown file in Winsock LSP: c:\windows\system32\winhealer.dll
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.downloadcontrol.com/files/insta…FreeInstall.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…tup1.0.0.15.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O21 - SSODL: DCOM Server 60787 - {2C1CD3D7-86AC-4068-93BC-A02304B60787} - (no file)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000132 (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UiBLZWxseSBGb3Jhbg\command.exe (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Motorola Digital Audio Player Manager (MotorolaDAP) - Motorola Inc. - C:\WINDOWS\system32\MotorolaDAP.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\hjenhdt.exe

MrCharlie

Post #2May 19, 2007, 4:31 PM UTC

Welcome to the forum.

You have a nice mess here….but we should be able to clean it up.

Do you use this computer for banking, etc, and do you have any personal info or passwords on the system?

———————-

Go to control panels add/remove programs and uninstall these if listed:

Zango Programs
OIN Search<—if not listed run this uninstaller HERE
MyWebSearch
WebHancer Survey Companion.
WebHancer Customer Companion
and anyother programs you don't recognize or didn't install…if you're not sure please ask first

———————–

Download WinSock XP Fix…run this program only if after running LSPFix you can't get back online.

Click HERE to download LSPFix.
Run it, make sure you click the "I know what I'm doing" button.
Select "winhealer.dll" and using the right-pointing 'arrows' and move all instances of "winhealer.dll" it mentions and nothing else to the Remove (RHS) side but leave everything else (it might already be over there when you open LSPFix).
Click the 'Finished' button (if you exit with the X at top right nothing happens).

——————–

Enable hidden files:
Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked.
Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK" (reverse this procedure when we are done)

——————-

Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:
Command Service

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

Do the same for these:

Network Monitor
Client IP-IPX
Net Agent
Windows Overlay Components
—————–

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

R3 - Default URLSearchHook is missing
O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll
O3 - Toolbar: OIN Search - {B9F6E8EB-A4E3-478E-88A4-D3995B5C45C8} - C:\Program Files\OIN Search\OINSearch.dll
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\bak\mwsoemon.exe
O4 - HKLM\..\Run: [{C0725C08-0AE8-1033-0415-040101040001}] "C:\Program Files\Common Files\{C0725C08-0AE8-1033-0415-040101040001}\Update.exe" te-110-12-0000213
O4 - HKLM\..\Run: [{C0725C08-0AE9-1033-0415-040101040001}] "C:\Program Files\Common Files\{C0725C08-0AE9-1033-0415-040101040001}\Update.exe" te-110-12-0000213
O4 - HKLM\..\Run: [hjenhdtA] C:\WINDOWS\hjenhdtA.exe
O4 - HKLM\..\Run: [win32077160-106624] C:\WINDOWS\win32077160-106624.exe
O4 - HKLM\..\Run: [{25-5C-C0-08-ZN}] C:\windows\system32\npdsregq.exe CHD001
O4 - HKLM\..\Run: [WindowsHive] C:\WINDOWS\system32\rpcc.exe
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…tup1.0.0.15.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab
O21 - SSODL: DCOM Server 60787 - {2C1CD3D7-86AC-4068-93BC-A02304B60787} - (no file)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UiBLZWxseSBGb3Jhbg\command.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000132 (file missing)
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\hjenhdt.exe

Click on Fix Checked and exit HijackThis.

——————–

Go to Start > Run and paste these commands into the open field (one at a time) hitting OK after each:

sc delete "Command Service"
sc delete "Network Monitor"
sc delete "Client IP-IPX"
sc delete cmdService
sc delete "Net Agent"
sc delete "Windows Overlay Components"
sc delete "Command Service (cmdService)"

———————-

Delete these files if found:

C:\Program Files\Common Files\{C0725C08-0AE8-1033-0415-040101040001}\Update.exe
C:\Program Files\Common Files\{C0725C08-0AE8-1033-0415-040101040001}<—folder too
C:\WINDOWS\hjenhdtA.exe
C:\WINDOWS\win32077160-106624.exe
C:\windows\system32\npdsregq.exe
C:\WINDOWS\system32\rpcc.exe
C:\WINDOWS\Temp\startdrv.exe
C:\WINDOWS\UiBLZWxseSBGb3Jhbg\command.exe
C:\WINDOWS\UiBLZWxseSBGb3Jhbg<—folder too
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\system32\svchosts.exe <—Please watch the spelling it's svchosts.exe not svchost.exe, notice the extra "S".
C:\WINDOWS\dls0523pmw.exe
C:\WINDOWS\hjenhdt.exe
winhealer.dll <—please search for this one.

Reboot and post a fresh HijackThis log and we'll take another look.
Please let me know if you can now stay online to download and run some programs, MrC

rkforan

Post #3May 19, 2007, 6:52 PM UTC

Thanks!

I completed all the listed actions. The new log file follows. Upon reboot, the system stayed up and I am able to connect to the internet. A couple of pop-ups came up in the 2 minutes I had IE open. I ran LSPFix, but not WinSock XP fix.

Kelly

Logfile of HijackThis v1.99.1
Scan saved at 1:40:37 PM, on 5/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\MotorolaDAP.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILE…MPHUd1Fh+lrhA==
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunOnce: [MyWebSearch bar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3
O4 - HKLM\..\RunOnce: [wbun] C:\WINDOWS\wbun.exe -q
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.downloadcontrol.com/files/insta…FreeInstall.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Motorola Digital Audio Player Manager (MotorolaDAP) - Motorola Inc. - C:\WINDOWS\system32\MotorolaDAP.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

MrCharlie

Post #4May 19, 2007, 10:25 PM UTC

Well Done!

Did you uninstall WebHancer from add/remove programs??
It still shows in your log:'
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer

Run LSPFix again:
Run it, make sure you click the "I know what I'm doing" button.
Click the 'Finished' button (if you exit with the X at top right nothing happens).

———————–

Download this file to your desktop:
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click on the deldomains.inf file and select 'Install'

Once it is finished your Zones should be reset.

—————–

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

O4 - HKLM\..\RunOnce: [MyWebSearch bar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3
O4 - HKLM\..\RunOnce: [wbun] C:\WINDOWS\wbun.exe -q

Click on Fix Checked and exit HijackThis.

Delete this file if found:

C:\WINDOWS\wbun.exe

————–

Reboot and…..

Clean out temp files:

Download and run ATF Cleaner - hit "select all" then just uncheck "cookies" (uncheck cookies is optional - leave it checked if you want to delete all cookies) then click "empty selected" That will clear out all the temp files on the system.

—————–

Download combofix.exe from the link below:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double click combofix.exe & follow the prompts.
A window will open with a warning.
Type "Y" (and Enter) to start the fix.
When the scan completes it will open a text window.
Please attach that log back here together with a fresh HJT log.
Caution - do not touch your mouse/keyboard until the scan has completed.
The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Combofix will automatically save the log file to C:\combofix.txt

———————-

Please download and install the 30 day trial version of AVG Anti-Spyware 7.5 here:
http://www.ewido.net/en/download/

After it's installed…Check for updates:
Double click on the AVG-AS icon in the system tray or on the desktop> this will bring up the main program if it's not already up.

On the Main Page click the Update Tab and then Start Update.
Download and install any updates if available.

Select the Scanner icon at the top of the screen, then select the Settings tab.
Once in the Settings screen click on Recommended actions and then select Quarantine.
Under Reports
Select Automatically generate report after every scan
Un-Select Only if threats were found

Close ALL open Windows / Programs / Folders.
Open up AVG-AS
Now click the Scanner Icon on top
Click on Complete System Scan
Be patient - it takes a while to run.

IMPORTANT! Do not save the report before you have clicked the Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button?

Once the scan is complete do the following:
If you have any infections you will prompted, then select Apply All Actions

Next select the Reports icon at the top.
Copy and paste the scan report in your next reply.

Close AVG-AS and Reboot in Normal Mode.

Post the log from AVG AS, ComboFix and a fresh HJT log, MrC

rkforan

Post #5May 19, 2007, 10:28 PM UTC

MrC,

I was able to get WebHancer off and all related files deleted. (It was not listed in the Add/Remove Control Window. I rebooted and ran a fresh HJT log. The system still is unstable. It was up under normal boot sequence for about 3 minutes before it rebooted. That's about 2:55 minutes longer than it wax staying up. I can reboot in safe mode with network connection and communicate with internet OK.

SpyHunter detected only one item: Trojan.Xorpix in the Registry. Used to be about a hundred items.

Kelly

Logfile of HijackThis v1.99.1
Scan saved at 5:03:52 PM, on 5/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILE…MPHUd1Fh+lrhA==
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\system32\spoolsvv.exe
O4 - HKLM\..\RunOnce: [wbun] C:\WINDOWS\wbun.exe -q
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Motorola Digital Audio Player Manager (MotorolaDAP) - Motorola Inc. - C:\WINDOWS\system32\MotorolaDAP.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

MrCharlie

Post #6May 19, 2007, 10:35 PM UTC

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\system32\spoolsvv.exe
O4 - HKLM\..\RunOnce: [wbun] C:\WINDOWS\wbun.exe -q

Click on Fix Checked and exit HijackThis.

Delete these files:

C:\WINDOWS\system32\spoolsvv.exe
C:\WINDOWS\wbun.exe

—————-

Please run the other scans as I asked, MrC

rkforan

Post #7May 20, 2007, 12:47 AM UTC

Got everything done. System seems to be stable now, but something is kept changing the folder options to not show hidden files every 10-20 seconds.

Here's the two of three Log files I will have to post the third in a second post (too big)

Kelly

Logfile of HijackThis v1.99.1
Scan saved at 7:29:01 PM, on 5/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\MotorolaDAP.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11E2A84B-158A-3503-F04A-6FE33BE4FECB} - C:\WINDOWS\system32\dnlagqf.dll (file missing)
O2 - BHO: (no name) - {1FE0FD4A-47D4-3057-A54A-6FE33BE4FF9C} - C:\WINDOWS\system32\mws.dll (file missing)
O2 - BHO: ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - C:\PROGRA~1\Ofb11\Ofb11.dll (file missing)
O2 - BHO: (no name) - {41B3F94B-1385-3F57-AB4A-6FE33BE4FBCA} - C:\WINDOWS\system32\kggt.dll (file missing)
O2 - BHO: (no name) - {44E5A841-41D1-6052-A34A-6FE33BE4FF9C} - C:\WINDOWS\system32\tfrlhsje.dll (file missing)
O2 - BHO: (no name) - {46B3AC40-1A86-6350-A54A-6FE33BE5AECB} - C:\WINDOWS\system32\qrj.dll (file missing)
O2 - BHO: H - {5142FE17-20E6-4121-A925-A4C6385CDDAA} - C:\WINDOWS\system32\rem.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: IE Redirector - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\WINDOWS\system32\dnsersnd.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Motorola Digital Audio Player Manager (MotorolaDAP) - Motorola Inc. - C:\WINDOWS\system32\MotorolaDAP.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

——————————————–

"Administrator" - 2007-05-19 17:47:21 Service Pack 2 [SAFE MODE]
ComboFix 07-05.20.3.V - Running from: "C:\Documents and Settings\Administrator\Desktop\"

(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ddcyy.dll
C:\WINDOWS\system32\ipxthkst.dll
C:\WINDOWS\system32\jvwbwsiv.dll
C:\WINDOWS\system32\kxmtvtui.dll
C:\WINDOWS\system32\yldkabxy.dll
C:\WINDOWS\system32\winxpn32.dll
C:\WINDOWS\system32\yycdd.ini
C:\WINDOWS\system32\ututv.bak2
C:\WINDOWS\system32\ututv.ini
C:\WINDOWS\system32\yxbakdly.ini
C:\WINDOWS\system32\vtutu.dll
C:\WINDOWS\system32\byxwtus.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\cfg32.exe
C:\WINDOWS\cfg32a.exe
C:\Program Files\Common Files\Yazzle1275OinAdmin.exe
C:\Program Files\Common Files\Yazzle1275OinUninstaller.exe
C:\WINDOWS\system32\1_exception.nls
C:\WINDOWS\system32\dlh9jkd1q2.exe
C:\WINDOWS\system32\dlh9jkd1q5.exe
C:\WINDOWS\system32\dlh9jkd1q6.exe
C:\WINDOWS\system32\dlh9jkd1q7.exe
C:\WINDOWS\system32\dlh9jkd1q8.exe
C:\WINDOWS\system32\kernels32.exe
C:\WINDOWS\system32\vexg4am1et2.exe
C:\WINDOWS\system32\vexg6ame4.exe
C:\WINDOWS\system32\vexga1me4t1.exe
C:\WINDOWS\system32\vexga3me2.exe
C:\WINDOWS\system32\vexga4m1et4.exe
C:\WINDOWS\system32\vexga4me1.exe
C:\WINDOWS\system32\vexga5me3.exe
C:\WINDOWS\system32\vexga8me6.exe
C:\WINDOWS\NDNuninstall7_48.exe
C:\WINDOWS\system32\alt.exe.exe
C:\WINDOWS\system32\pee.exe.exe
C:\WINDOWS\retadpu1000106.exe
C:\WINDOWS\retadpu27.exe
C:\WINDOWS\retadpu72.exe
C:\DOCUME~1\Owner\APPLIC~1\Install.dat
C:\WINDOWS\system32\max1d164v.exe
C:\WINDOWS\system32\drivers\ip6fw.sys
C:\WINDOWS\system32\wsjuo.dll
C:\Documents and Settings\All Users.\documents\settings\desktop.ini
C:\Program Files\bravesentry\BraveSentry.lic
C:\Program Files\bravesentry\BraveSentry0.bs
C:\Program Files\bravesentry\BraveSentry1.bs
C:\Program Files\bravesentry\Uninstall.exe
C:\Program Files\cowabanga\uninstaller.exe
C:\Program Files\ipwindows\UnInstall.exe
C:\Program Files\ipwins\Uninst.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\spysheriff\base.avd
C:\Program Files\spysheriff\base001.avd
C:\Program Files\spysheriff\base002.avd
C:\Program Files\spysheriff\found.wav
C:\Program Files\spysheriff\heur000.dll
C:\Program Files\spysheriff\heur001.dll
C:\Program Files\spysheriff\heur002.dll
C:\Program Files\spysheriff\heur003.dll
C:\Program Files\spysheriff\notfound.wav
C:\Program Files\spysheriff\removed.wav
C:\Program Files\spysheriff\SpySheriff.dvm
C:\Program Files\spysheriff\Uninstall.exe
C:\WINDOWS\system32\msdrives\driverpp.sys
C:\WINDOWS\system32\msdrives\msdrvctrl.exe
C:\Program Files\newdotnet\newdotnet7_48.dll
C:\Program Files\newdotnet\readme.html
C:\Program Files\newdotnet\uninstall7_48.exe
C:\WINDOWS\system32\smpi1\lb5.exe
C:\WINDOWS\system32\smpi1\lib06.exe
C:\WINDOWS\system32\smpi1\lib67.exe
C:\Temp\17O7\tmpTF.log
C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon\domains.txt
C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon\log.txt
C:\WINDOWS\system32\dwdsregt.exe
C:\WINDOWS\system32\ksys.sys
C:\WINDOWS\system32\spoolsvv.exe
C:\WINDOWS\system32\svchosts.lzma
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\unsvchosts.lzma
C:\WINDOWS\system32\userinit.dll
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\wincom32.ini
C:\WINDOWS\system32\wincom32.sys
C:\WINDOWS\system32\winsub.xml
C:\windows\xpupdate.exe
C:\WINDOWS\iedrives.dll
C:\WINDOWS\msdrvctrl.exe
C:\WINDOWS\offun.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\uni_e6h.exe
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\windev-peers.ini
C:\WINDOWS\system32\spoolsvv.sys
C:\WINDOWS\opera6.ini
C:\WINDOWS\system32\helper.sys
C:\WINDOWS\system32\dnsersnd.dll
C:\WINDOWS\sammy3.exe
C:\WINDOWS\msnfo32s.exe
C:\WINDOWS\rau001978.exe
C:\Program Files\bravesentry
C:\Program Files\cowabanga
C:\Program Files\inetget2
C:\Program Files\ipwindows
C:\Program Files\ipwins
C:\Program Files\network monitor
C:\Program Files\outerinfo
C:\Program Files\spysheriff
C:\WINDOWS\system32\msdrives
C:\Program Files\newdotnet
C:\WINDOWS\system32\smpi1
C:\Temp\17O7
C:\Temp\tn3
C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon
C:\Documents and Settings\All Users.\documents\settings\winsys2f.dll
C:\WINDOWS\system32\a3dxx.dll
C:\WINDOWS\system32\rpcc1.dll
C:\Documents and Settings\All Users.\documents\settings
C:\WINDOWS\system32\comdlg77.dll
C:\WINDOWS\system32\drivers\runtime2.sys
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\Program Files\APPATC~1
C:\qoobox\purity\C\Program Files\FNTS~1
C:\qoobox\purity\C\Program Files\ICROSO~1
C:\qoobox\purity\C\Program Files\PPPATC~1
C:\qoobox\purity\C\Program Files\RACLE~1
C:\qoobox\purity\C\Program Files\SMANTE~1
C:\qoobox\purity\C\Program Files\SMBOLS~1
C:\qoobox\purity\C\Program Files\SSEMBL~1
C:\qoobox\purity\C\Program Files\Common Files\CROSOF~1
C:\qoobox\purity\C\Program Files\Common Files\DOBE~1
C:\qoobox\purity\C\Program Files\Common Files\ICROSO~1
C:\qoobox\purity\C\Program Files\Common Files\MCROSO~1.NET
C:\qoobox\purity\C\Program Files\Common Files\PPATCH~1
C:\qoobox\purity\C\Program Files\Common Files\RACLE~1
C:\qoobox\purity\C\Program Files\Common Files\SEMBLY~1
C:\qoobox\purity\C\Program Files\Common Files\SKS~1
C:\qoobox\purity\C\Program Files\Common Files\SMBOLS~1
C:\qoobox\purity\C\Program Files\Common Files\WNSXS~1
C:\qoobox\purity\C\Program Files\Common Files\YMBOLS~1
C:\qoobox\purity\C\Program Files\Common Files\YSTEM3~1
C:\qoobox\purity\C\WINDOWS\DOBE~1
C:\qoobox\purity\C\WINDOWS\ECURIT~1
C:\qoobox\purity\C\WINDOWS\FNTS~1
C:\qoobox\purity\C\WINDOWS\ICROSO~1
C:\qoobox\purity\C\WINDOWS\PPPATC~2
C:\qoobox\purity\C\WINDOWS\RACLE~1
C:\qoobox\purity\C\WINDOWS\RACLE~2
C:\qoobox\purity\C\WINDOWS\SKS~1
C:\qoobox\purity\C\WINDOWS\SSTEM3~1
C:\qoobox\purity\C\WINDOWS\WNSXS~1
C:\qoobox\purity\C\WINDOWS\YMANTE~1
C:\qoobox\purity\C\WINDOWS\SSTEM3~1\s?stem32
C:\qoobox\purity\C\WINDOWS\system32\ASEMBL~1
C:\qoobox\purity\C\WINDOWS\system32\CROSOF~1
C:\qoobox\purity\C\WINDOWS\system32\DOBE~1
C:\qoobox\purity\C\WINDOWS\system32\ECURIT~1
C:\qoobox\purity\C\WINDOWS\system32\PPPATC~1
C:\qoobox\purity\C\WINDOWS\system32\RACLE~1
C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1

((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_CORE
——-\LEGACY_DRIVER
——-\LEGACY_DRIVERPP
——-\LEGACY_NDNET1
——-\LEGACY_RUNTIME
——-\LEGACY_RUNTIME2
——-\LEGACY_WINCOM32
——-\core
——-\Driver
——-\driverpp
——-\msdirectx
——-\NDnet1
——-\Runtime

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-19 ))))))))))))))))))))))))))))))))))

2007-05-19 12:16 360,448 –a—— C:\Program Files\Uninstall My Web Search.dll
2007-05-17 23:12 262,144 –ah—– C:\DOCUME~1\Kelly\ntuser.dat
2007-05-17 23:12 262,144 –a—— C:\DOCUME~1\Sheri\ntuser.dat
2007-05-17 23:12 262,144 –a—— C:\DOCUME~1\Owner\ntuser.dat
2007-05-17 18:55 786,432 –ah—– C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-05-17 15:53 6,688 –a—— C:\WINDOWS\system32\sqvxga7met4.exe
2007-05-17 15:53 18,432 –a—— C:\WINDOWS\system32\sqvxga6met3.exe
2007-05-16 19:25 133,162 –a—— C:\WINDOWS\system32\alt.exe
2007-05-16 19:23 152,192 –a—— C:\WINDOWS\system32\windev-38d2-413b.sys
2007-05-16 19:17 11,264 –a—— C:\WINDOWS\smanager.7.exe
2007-05-16 19:09 192,205 –a—— C:\WINDOWS\minisetup55.exe
2007-05-16 19:09 d——– C:\Program Files\pasystem
2007-05-16 19:09 d——– C:\Program Files\Ofb11
2007-05-16 19:08 929 –a—— C:\WINDOWS\system32\winpfz32.sys
2007-05-16 19:08 184,422 –a—— C:\WINDOWS\system32\rwinqodv.exe
2007-05-16 19:07 631,920 -r-hs—- C:\WINDOWS\hjenhdtA.exe
2007-05-16 19:07 217,276 –a—— C:\WINDOWS\Setup89.exe
2007-05-16 19:07 14,390 –a—— C:\syseroo.exe
2007-05-16 19:07 d——– C:\Temp
2007-05-14 21:20 70,720 –a—— C:\WINDOWS\system32\B37hKQwM.exe
2007-05-11 20:47 d——– C:\DOCUME~1\Owner\APPLIC~1\Apple Computer
2007-05-08 21:12 1 –a—— C:\WINDOWS\system32\ps.dat
2007-05-08 21:12 1 –a—— C:\WINDOWS\system32\cookie.dat
2007-05-08 21:10 55,296 –a—— C:\sysxtay.exe
2007-05-08 21:10 40,503 –a—— C:\WINDOWS\system32\rem1.dll
2007-05-08 21:10 40,503 –a—— C:\WINDOWS\system32\rem.dll
2007-04-27 01:02 32,768 –a—— C:\Temp\SB1083.exe

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-19 17:44:09 ——– d—–w C:\Program Files\Inspiration 7.6 Trial
2007-05-19 17:39:43 ——– d—–w C:\Program Files\Viewpoint
2007-05-19 17:30:33 ——– d—–w C:\Program Files\REGSHAVE
2007-05-19 17:16:18 ——– d—a-w C:\Program Files\MyWebSearch
2007-05-09 00:21:30 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-05-08 00:50:15 ——– d—–w C:\Program Files\Common Files\fwou
2007-05-08 00:50:00 ——– d—–w C:\Program Files\WinAntiVirus Pro 2006
2007-05-05 05:47:36 ——– d—–w C:\Program Files\Yahoo! Games
2007-04-06 22:23:24 ——– d—–w C:\Program Files\LimeWire
2007-03-25 10:57:39 135 –s-a-w C:\WINDOWS\url1.bat
2007-03-17 23:59:26 116,952 —-a-w C:\sysegrg.exe
2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll
2007-03-15 17:23:16 497,496 —-a-w C:\WINDOWS\system32\XceedZip.dll
2007-03-15 17:19:58 526,184 —-a-w C:\WINDOWS\system32\XceedCry.dll
2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 —-a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 —-a-w C:\WINDOWS\system32\win32k.sys
2007-03-06 09:41:30 90,112 —-a-w C:\WINDOWS\KVTE66.exe
2007-02-10 10:03:21 268,704 —-a-w C:\WINDOWS\OfB11_Setup.exe
2007-02-05 20:17:02 185,344 —-a-w C:\WINDOWS\system32\upnphost.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2005-11-04 19:29]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 15:17]
{11E2A84B-158A-3503-F04A-6FE33BE4FECB}=C:\WINDOWS\system32\dnlagqf.dll []
{1FE0FD4A-47D4-3057-A54A-6FE33BE4FF9C}=C:\WINDOWS\system32\mws.dll []
{3E1500AC-87A5-416b-A211-82E848649DA9}=C:\PROGRA~1\Ofb11\Ofb11.dll [2007-05-16 19:09]
{41B3F94B-1385-3F57-AB4A-6FE33BE4FBCA}=C:\WINDOWS\system32\kggt.dll []
{44E5A841-41D1-6052-A34A-6FE33BE4FF9C}=C:\WINDOWS\system32\tfrlhsje.dll []
{46B3AC40-1A86-6350-A54A-6FE33BE5AECB}=C:\WINDOWS\system32\qrj.dll []
{5142FE17-20E6-4121-A925-A4C6385CDDAA}=C:\WINDOWS\system32\rem.dll [2007-05-10 15:35]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=C:\Program Files\Yahoo!\Common\yiesrvc.dll [2005-08-17 09:40]
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}=C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll [2006-11-02 15:04]
{BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Program Files\Norton AntiVirus\NavShExt.dll [2004-08-18 02:44]
{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53}=C:\WINDOWS\system32\dnsersnd.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"="Atiptaxx.exe" [2001-10-10 16:59 C:\WINDOWS\system32\atiptaxx.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-16 22:00]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-11-16 22:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-11-16 22:00]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2006-11-16 22:00]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"SpyHunter"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 16:04]
"UserFaultCheck"="%systemroot%\system32\dumprep 0 -u" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"FlashPlayerUpdate"=C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
AutoRun\command- D:\Setup.exe

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070519-164220-279
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab

??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????=??????????????????

backup-20070519-164219-934
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.downloadcontrol.com/files/insta…FreeInstall.cab

???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????=??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????=??????????????????

backup-20070519-164219-214
O4 - HKLM\..\RunOnce: [MyWebSearch bar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3

backup-20070519-131101-500
O21 - SSODL: DCOM Server 60787 - {2C1CD3D7-86AC-4068-93BC-A02304B60787} - (no file)

backup-20070519-131101-725
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab

??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????=??????????????????

backup-20070519-131059-593
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…tup1.0.0.15.cab

??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????=?????????????`????

backup-20070519-131059-839
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe

backup-20070519-131059-219
O4 - HKLM\..\Run: [WindowsHive] C:\WINDOWS\system32\rpcc.exe

backup-20070519-131059-551
O4 - HKLM\..\Run: [{25-5C-C0-08-ZN}] C:\windows\system32\npdsregq.exe CHD001

backup-20070519-131059-539
O4 - HKLM\..\Run: [win32077160-106624] C:\WINDOWS\win32077160-106624.exe

backup-20070519-131058-868
O4 - HKLM\..\Run: [{C0725C08-0AE9-1033-0415-040101040001}] "C:\Program Files\Common Files\{C0725C08-0AE9-1033-0415-040101040001}\Update.exe" te-110-12-0000213

backup-20070519-131059-272
O4 - HKLM\..\Run: [hjenhdtA] C:\WINDOWS\hjenhdtA.exe

backup-20070519-131058-178
O4 - HKLM\..\Run: [{C0725C08-0AE8-1033-0415-040101040001}] "C:\Program Files\Common Files\{C0725C08-0AE8-1033-0415-040101040001}\Update.exe" te-110-12-0000213

backup-20070519-131058-522
R3 - Default URLSearchHook is missing

backup-20070519-131058-783
O3 - Toolbar: OIN Search - {B9F6E8EB-A4E3-478E-88A4-D3995B5C45C8} - C:\Program Files\OIN Search\OINSearch.dll (file missing)
Contents of the 'Scheduled Tasks' folder
2007-05-01 22:52:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At1.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At10.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At11.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At12.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At13.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At14.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At15.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At16.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At17.job
2007-05-19 22:00:00 C:\WINDOWS\tasks\At18.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At19.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At2.job
2007-05-17 00:01:56 C:\WINDOWS\tasks\At20.job
2007-05-17 01:01:29 C:\WINDOWS\tasks\At21.job
2007-05-17 02:00:30 C:\WINDOWS\tasks\At22.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At23.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At24.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At3.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At4.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At5.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At6.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At7.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At8.job
2007-05-15 02:20:10 C:\WINDOWS\tasks\At9.job
2007-04-21 01:00:00 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Owner.job
2007-05-17 20:28:20 C:\WINDOWS\tasks\Symantec NetDetect.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-19 17:59:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

********************************************************************

Completion time: 2007-05-19 18:00:31 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-05-19 18:00

— E O F —

rkforan

Post #8May 20, 2007, 12:51 AM UTC

AVG Report too big also. will split it up. Kelly ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 7:24:35 PM 5/19/2007 + Scan result: C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0243032.exe -> Adware.180Solutions : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244368.exe -> Adware.888Bar : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\iedrives.dll.vir -> Adware.Agent : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\msdrvctrl.exe.vir -> Adware.Agent : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\msdrives\driverpp.sys.vir -> Adware.Agent : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\msdrives\msdrvctrl.exe.vir -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168616.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168618.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168619.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212706.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212707.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212708.sys -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212709.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231798.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231799.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231800.sys -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231801.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233890.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233891.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233892.sys -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233893.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241995.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241996.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241997.sys -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241998.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0243031.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0243085.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245459.sys -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245460.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245473.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245474.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\offun.exe.vir -> Adware.Bagon : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245475.exe -> Adware.Bagon : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244367.dll -> Adware.Bar888 : Cleaned with backup (quarantined). C:\Program Files\WinBudget\bin\matrix.dll -> Adware.BHO : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0237923.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0237923.dll -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238910.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238910.dll -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238911.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238911.dll -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238913.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238913.exe -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238914.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238914.exe -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\cfg32o.dll.dat/WINDOWS/cfg32o.dll -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\cfg32r.dll.dat/WINDOWS/cfg32r.dll -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\cfg32s.dll.dat/WINDOWS/cfg32s.dll -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\stub_mma1.exe.dat/WINDOWS/stub_mma1.exe -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\stub_track3.exe.dat/WINDOWS/stub_track3.exe -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\cfg32.exe.vir -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\cfg32a.exe.vir -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245421.exe -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245422.exe -> Adware.BookedSpace : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238917.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238917.dll -> Adware.BraveSentry : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238918.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238918.dll -> Adware.BraveSentry : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238919.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238919.dll -> Adware.BraveSentry : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\bravesentry.exe.dat/Program Files/BraveSentry/BraveSentry.exe -> Adware.BraveSentry : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\bravesentry0.dll.dat/Program Files/BraveSentry/BraveSentry0.dll -> Adware.BraveSentry : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\bravesentry2.dll.dat/Program Files/BraveSentry/BraveSentry2.dll -> Adware.BraveSentry : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\bravesentry3.dll.dat/Program Files/BraveSentry/BraveSentry3.dll -> Adware.BraveSentry : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0238920.exe -> Adware.BraveSentry : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238923.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238923.exe -> Adware.CommAd : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238924.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238924.dll -> Adware.CommAd : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\installer[1].exe.dat/Documents and Settings/Owner/Local Settings/Temporary Internet Files/Content.IE5/8XOD2FOD/installer[1].exe -> Adware.CommAd : Cleaned with backup (quarantined). C:\Program Files\DriveCleaner 2006 Free -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\Program Files\DriveCleaner 2006 Free\Appbase -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\Program Files\DriveCleaner 2006 Free\Download -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\Program Files\DriveCleaner 2006 Free\img -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\Program Files\DriveCleaner 2006 Free\unins000.exe -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\Program Files\DriveCleaner 2006 Free\uninstall.ico -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\pv.exe.dat/Program Files/DriveCleaner 2006 Free/pv.exe -> Adware.DriveCleaner : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} -> Adware.Generic : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0124156.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP561/A0124156.dll -> Adware.Maxifiles : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0124157.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP561/A0124157.exe -> Adware.Maxifiles : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125442.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP592/A0125442.exe -> Adware.Maxifiles : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125443.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP592/A0125443.dll -> Adware.Maxifiles : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\amm06.ocx.dat/WINDOWS/Downloaded Program Files/amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\BraveSentry\BraveSentry0.bs.vir -> Adware.MrAntispy : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238912.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238912.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238916.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238916.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\ndnuninstall6_38.exe.dat/WINDOWS/NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\uninstall6_38.exe.dat/Program Files/NewDotNet/uninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\NewDotNet\newdotnet7_48.dll.vir -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\NewDotNet\uninstall7_48.exe.vir -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall7_48.exe.vir -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164566.dll -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245439.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245461.dll -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245462.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\SpySheriff\base.avd.vir -> Adware.Pesttrap : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\SpySheriff\base001.avd.vir -> Adware.Pesttrap : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125409.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP589/A0125409.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125447.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP592/A0125447.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125452.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP592/A0125452.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125453.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP592/A0125453.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0127451.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP596/A0127451.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0127452.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP596/A0127452.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0128447.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP596/A0128447.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0132460.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP599/A0132460.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0132461.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP599/A0132461.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0133454.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP599/A0133454.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0137498.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP603/A0137498.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0137499.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP603/A0137499.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0138493.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP604/A0138493.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0139558.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP608/A0139558.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0140493.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP611/A0140493.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0140494.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP611/A0140494.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0151497.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP618/A0151497.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0151498.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP618/A0151498.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0151499.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP618/A0151499.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0153513.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP619/A0153513.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154508.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154508.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154547.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154547.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154549.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154549.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154550.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154550.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154551.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154551.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0156585.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP622/A0156585.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0158570.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP623/A0158570.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0158571.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP623/A0158571.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0160590.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP624/A0160590.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0160591.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP624/A0160591.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0161591.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP625/A0161591.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0161592.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP625/A0161592.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0161594.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP625/A0161594.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0161595.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP625/A0161595.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238915.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238915.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0238922.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0238922.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\dnlagqf.dll.dat/WINDOWS/system32/dnlagqf.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\kggt.dll.dat/WINDOWS/system32/kggt.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\kooyjhkv.dll.dat/WINDOWS/system32/kooyjhkv.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\oiuninstaller.exe.dat/Program Files/Outerinfo/OiUninstaller.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\qrj.dll.dat/WINDOWS/system32/qrj.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\userinit.dll.vir -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP559\A0124087.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP560\A0124118.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP561\A0124125.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP579\A0124357.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP580\A0124362.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP580\A0124363.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124397.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124398.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124399.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124400.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124401.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124402.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124403.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124404.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124405.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124406.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124419.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP582\A0124420.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP589\A0125397.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP589\A0125401.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP592\A0125454.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP618\A0152499.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245469.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154537.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154537.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154538.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154538.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154539.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154539.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154540.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154540.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154553.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154553.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154554.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154554.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154555.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154555.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\update.exe.dat/RECYCLER/S-1-5-18/Dc1/Update.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\update.exe.dat/RECYCLER/S-1-5-18/Dc2/Update.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\update.exe.dat/RECYCLER/S-1-5-21-839522115-412668190-725345543-1006/Dc330/Update.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\update.exe.dat/RECYCLER/S-1-5-21-839522115-412668190-725345543-1006/Dc343/Update.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-18\Dc3\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-839522115-412668190-725345543-1006\Dc344\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP590\A0125422.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244346.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244369.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\SpySheriff\heur000.dll.vir -> Adware.SpySheriff : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\SpySheriff\heur002.dll.vir -> Adware.SpySheriff : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245454.dll -> Adware.SpySheriff : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245456.dll -> Adware.SpySheriff : Cleaned with backup (quarantined). C:\Documents and Settings\All Users\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\All Users\Application Data\Starware\buttons -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\All Users\Application Data\Starware\contexts -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\All Users\Application Data\Starware\images -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\BrowserSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\BuddyIcons -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\ErrorSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\Layouts -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\Manager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\PopupBlocker -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\Reference -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\RelatedSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\SearchMatch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\SitePager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\SmileyTown -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\Toolbar -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\ToolbarLogo -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\ToolbarSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\TravelSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kaitlin\Application Data\Starware\Weather -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\BrowserSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\BuddyIcons -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\ErrorSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\Layouts -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\Manager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\PopupBlocker -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\Reference -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\RelatedSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\SearchMatch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\SitePager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\SmileyTown -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\Toolbar -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\ToolbarLogo -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\ToolbarSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\TravelSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Kelly\Application Data\Starware\Weather -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\BrowserSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\BuddyIcons -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\ErrorSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\Layouts -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\Manager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\PopupBlocker -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\Reference -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\RelatedSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\SearchMatch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\SitePager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\SmileyTown -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\Toolbar -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\ToolbarLogo -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\ToolbarSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\TravelSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Application Data\Starware\Weather -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\BrowserSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\BuddyIcons -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\ErrorSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\Layouts -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\Manager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\PopupBlocker -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\Reference -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\RelatedSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\SearchMatch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\SitePager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\SmileyTown -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\Toolbar -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\ToolbarLogo -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\ToolbarSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\TravelSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Application Data\Starware\Weather -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\BrowserSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\BuddyIcons -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\ErrorSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\Layouts -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\Manager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\PopupBlocker -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\Reference -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\RelatedSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\SearchMatch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\SitePager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\SmileyTown -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\Toolbar -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\ToolbarLogo -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\ToolbarSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\TravelSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Sheri\Application Data\Starware\Weather -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Starware -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Starware\StarwareUninstall.exe -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Starware\bin -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Starware\bin\Starware.dll -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Starware\icons -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Starware\icons\star_16.ico -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Starware\qr.exe -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Starware\ze.exe -> Adware.Starware : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA356D79-679B-4B4C-8E49-5AF97014F4C1} -> Adware.Starware : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D49E9D35-254C-4C6A-9D17-95018D228FF5} -> Adware.Starware : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Starware -> Adware.Starware : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Starware\Options -> Adware.Starware : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Starware\OriginalAutoSearch -> Adware.Starware : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Starware\OriginalSearchAssistant -> Adware.Starware : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Starware\OriginalURLSearchHooks -> Adware.Starware : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Starware\SearchAssistant -> Adware.Starware : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA356D79-679B-4B4C-8E49-5AF97014F4C1} -> Adware.Starware : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D49E9D35-254C-4C6A-9D17-95018D228FF5} -> Adware.Starware : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Starware -> Adware.Starware : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Starware\Options -> Adware.Starware : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Starware\OriginalAutoSearch -> Adware.Starware : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Starware\OriginalSearchAssistant -> Adware.Starware : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Starware\OriginalURLSearchHooks -> Adware.Starware : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Starware\SearchAssistant -> Adware.Starware : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154541.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154541.dll -> Adware.TargetServer : Cleaned with backup (quarantined).

rkforan

Post #9May 20, 2007, 12:52 AM UTC

Second half of AVG report C:\Program Files\Enigma Software Group\SpyHunter\Backup\fwouc.dll.dat/Program Files/Common Files/fwou/fwoud/fwouc.dll -> Adware.TargetServer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP565\A0124202.exe -> Adware.ValueAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP566\A0124221.exe -> Adware.ValueAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0243122.dll -> Adware.Viewpoint : Cleaned with backup (quarantined). C:\Program Files\AWS\WeatherBug\bak\Weather.EXE -> Adware.WeatherBug : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164564.exe -> Adware.WebBuying : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0243086.dll -> Adware.WebBuying : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0243088.exe -> Adware.WebBuying : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245399.exe -> Adware.WebBuying : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154531.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154531.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154532.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154532.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154533.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154533.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0160572.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP623/A0160572.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0160574.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP623/A0160574.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0160587.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP624/A0160587.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0161564.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP624/A0161564.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0161589.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP625/A0161589.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\whinstaller.exe.dat/Program Files/webHancer/Programs/whinstaller.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP586\snapshot\MFEX-1.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP586\snapshot\MFEX-2.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP586\snapshot\MFEX-3.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP587\snapshot\MFEX-1.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP587\snapshot\MFEX-2.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP587\snapshot\MFEX-3.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP588\snapshot\MFEX-1.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP588\snapshot\MFEX-2.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP588\snapshot\MFEX-3.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP589\A0125398.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP589\A0125399.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP589\A0125400.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP589\snapshot\MFEX-1.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP589\snapshot\MFEX-2.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP589\snapshot\MFEX-3.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP592\A0125462.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP599\A0132473.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP599\A0132474.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP599\A0132475.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP599\A0132478.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP599\A0133455.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP599\A0133456.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP599\A0133457.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP624\A0161565.exe -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP624\A0161566.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP624\snapshot\MFEX-1.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP624\snapshot\MFEX-4.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP624\snapshot\MFEX-5.DAT -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP625\A0161588.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244388.dll -> Adware.WebHancer : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\wapchk.dll.dat/Program Files/Common Files/Companion Wizard/WapCHK.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\wapchk.dll.dat/Program Files/Common Files/WinAntiVirus Pro 2006/WapCHK.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined). C:\Program Files\WinAntiVirus Pro 2006 -> Adware.WinAntiVirus : Cleaned with backup (quarantined). HKLM\SYSTEM\CurrentControlSet\Services\vspf -> Adware.WinAntiVirus : Cleaned with backup (quarantined). HKLM\SYSTEM\CurrentControlSet\Services\vspf\Enum -> Adware.WinAntiVirus : Cleaned with backup (quarantined). HKLM\SYSTEM\CurrentControlSet\Services\vspf\Security -> Adware.WinAntiVirus : Cleaned with backup (quarantined). HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk -> Adware.WinAntiVirus : Cleaned with backup (quarantined). HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Enum -> Adware.WinAntiVirus : Cleaned with backup (quarantined). HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Security -> Adware.WinAntiVirus : Cleaned with backup (quarantined). HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178F3FB-2560-458F-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Cleaned with backup (quarantined). HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178F3FB-2560-458F-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\dwdsregt.exe.vir -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244348.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245466.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\WINDOWS\system32\rwinqodv.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\smpi1\lib67.exe.vir -> Adware.ZQuest : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245465.exe -> Adware.ZQuest : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\14.tmp.exe.dat/Documents and Settings/Owner/Local Settings/Temp/14.tmp.exe -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\5c.tmp.exe.dat/Documents and Settings/Kelly/Local Settings/Temp/5C.tmp.exe -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\61.tmp.exe.dat/Documents and Settings/Kelly/Local Settings/Temp/61.tmp.exe -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0237918.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0237918.exe -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\qwertybot.exe.dat/WINDOWS/system32/qwertybot.exe -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\qwertybotx[1].exe.dat/Documents and Settings/Kelly/Local Settings/Temporary Internet Files/Content.IE5/HJZ9RDZO/qwertybotx[1].exe -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\comdlg77.dll.vir -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164581.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165579.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0167596.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168606.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0170628.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0171633.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212677.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231769.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233861.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0236913.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241936.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244370.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245506.dll -> Backdoor.Agent.alp : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\max1d164v.exe.vir -> Dialer.GBDialer.i : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245445.exe -> Dialer.GBDialer.i : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154548.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154548.exe -> Downloader.Age : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0161593.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP625/A0161593.exe -> Downloader.Age : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\dllhost.exe.dat/Documents and Settings/Kelly/My Documents/s?stem32/dllhost.exe -> Downloader.Age : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\mshtml3.exe.dat/Documents and Settings/Owner/Local Settings/Temp/mshtml3.exe -> Downloader.Age : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\ntvdm.exe.dat/Documents and Settings/Sheri/My Documents/?ssembly/ntvdm.exe -> Downloader.Age : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\ip6fw.sys.vir -> Downloader.Agent.acl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245446.sys -> Downloader.Agent.acl : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125421.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP590/A0125421.exe -> Downloader.Agent.bca : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244349.exe -> Downloader.Agent.bca : Cleaned with backup (quarantined). C:\sysegrg.exe -> Downloader.Agent.bhc : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\retadpu1000106.exe.vir -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\retadpu27.exe.vir -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\retadpu72.exe.vir -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\smpi1\lib06.exe.vir -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\vexga5me3.exe.vir -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP618\A0152498.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164591.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164596.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165587.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0167609.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168623.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168625.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0170636.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0170641.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0171644.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212667.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212687.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231759.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231779.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233851.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233871.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0236921.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241928.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241976.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245437.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245442.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245443.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245444.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245464.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\Program Files\pasystem\pasystem.exe -> Downloader.Agent.bpi : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164582.exe -> Downloader.Agent.bpi : Cleaned with backup (quarantined). C:\WINDOWS\smanager.7.exe -> Downloader.Alphabet : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1275OinAdmin.exe.vir -> Downloader.PurityScan.eg : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP614\A0146503.exe -> Downloader.PurityScan.eg : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245423.exe -> Downloader.PurityScan.eg : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125465.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP592/A0125465.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0132470.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP599/A0132470.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154552.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154552.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154557.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154557.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0161599.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP625/A0161599.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\WINDOWS\system32\cgrvo.dat -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\Program Files\AIM\aim.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\Program Files\AWS\WeatherBug\Weather.EXE -> Downloader.Small : Cleaned with backup (quarantined). C:\Program Files\Common Files\Symantec Shared\ccApp.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0237915.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0237915.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\dlh9jkd1q1.exe.dat/WINDOWS/system32/dlh9jkd1q1.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\Program Files\SymNetDrv\SNDMon.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\Program Files\Yahoo!\Messenger\ypager.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP592\A0125439.dll -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP592\A0125464.dll -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP598\A0129480.dll -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0237919.dll -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0243111.EXE -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0243147.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\WINDOWS\system32\NeroCheck.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154535.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154535.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212682.exe -> Downloader.Small.eci : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231774.exe -> Downloader.Small.eci : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233866.exe -> Downloader.Small.eci : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241972.exe -> Downloader.Small.eci : Cleaned with backup (quarantined). C:\WINDOWS\system32\sqvxga7met4.exe -> Downloader.Small.eci : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\vexga3me2.exe.vir -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164590.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165586.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168612.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0170634.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0171642.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212669.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231761.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233853.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0236918.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241931.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245434.exe -> Downloader.Small.eip : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154542.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154542.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\fwoup.exe.dat/Program Files/Common Files/fwou/fwoup.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined). C:\Program Files\Common Files\fwou\fwoud\vocabulary -> Downloader.TSUpdate.j : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154545.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154545.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\fwoua.exe.dat/Program Files/Common Files/fwou/fwoua.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154543.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154543.exe -> Downloader.TSUpdate.n : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\fwoum.exe.dat/Program Files/Common Files/fwou/fwoum.exe -> Downloader.TSUpdate.n : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154546.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154546.exe -> Downloader.TSUpdate.o : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154544.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154544.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\fwoul.exe.dat/Program Files/Common Files/fwou/fwoul.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined). C:\Temp\SB1083.exe -> Downloader.VB.awj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244351.exe -> Downloader.Zlob.bqw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164598.exe -> Dropper.Agent.bge : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212685.exe -> Dropper.Agent.bge : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231777.exe -> Dropper.Agent.bge : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233869.exe -> Dropper.Agent.bge : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241975.exe -> Dropper.Agent.bge : Cleaned with backup (quarantined). C:\WINDOWS\system32\sqvxga6met3.exe -> Dropper.Agent.bge : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\ipwins\Uninst.exe.vir -> Dropper.DollarR.b : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245452.exe -> Dropper.DollarR.b : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP587\A0124462.exe -> Dropper.Purity.aj : Cleaned with backup (quarantined). C:\WINDOWS\run2.exe -> Dropper.VB.nn : Cleaned with backup (quarantined). C:\WINDOWS\system32:lzx32.sys -> Hijacker.Costrat.ah : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\dnsersnd.dll.vir -> Hijacker.Small.cf : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245484.dll -> Hijacker.Small.cf : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP622\A0157573.dll -> Logger.Banker.cnq : Cleaned with backup (quarantined). C:\WINDOWS\system32\rem.dll -> Logger.Banker.cnq : Cleaned with backup (quarantined). C:\WINDOWS\system32\rem1.dll -> Logger.Banker.cnq : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UDC6_0001_D19M1908NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.m : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\UDC6_0001_D19M1908NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.m : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\uwa7p_0001_n91m0809netinstaller.exe.dat/WINDOWS/Downloaded Program Files/UWA7P_0001_N91M0809NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.10\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.3\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.4\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.5\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.6\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.7\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.8\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\CONFLICT.9\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\UWAS6_0001_N91M1508NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0125444.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP592/A0125444.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0237911.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0237911.dll -> Proxy.Agent.df : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\zv.dll.dat/WINDOWS/system32/zv.dll -> Proxy.Agent.df : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\spoolsvv.sys.vir -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\vexga4m1et4.exe.vir -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164595.exe -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165588.exe -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0167608.exe -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0170637.exe -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241926.exe -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241935.sys -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244394.exe -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244395.sys -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245435.exe -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245481.sys -> Proxy.Agent.ji : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\rpcc1.dll.vir -> Proxy.Dlena : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0170642.dll -> Proxy.Dlena : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245500.dll -> Proxy.Dlena : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164601.exe -> Proxy.Dlena.ad : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165590.exe -> Proxy.Dlena.ad : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0171634.exe -> Proxy.Dlena.ad : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212666.exe -> Proxy.Dlena.ad : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231758.exe -> Proxy.Dlena.ad : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233850.exe -> Proxy.Dlena.ad : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0236923.exe -> Proxy.Dlena.ad : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\maindll.dll.dat/Documents and Settings/Kelly/Local Settings/Temp/maindll.dll -> Proxy.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\maindll.dll.dat/Documents and Settings/Owner/Local Settings/Temp/maindll.dll -> Proxy.Small : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\svchost.exe.vir -> Proxy.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245476.exe -> Proxy.Small : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Documents and Settings\All Users\Documents\Settings\winsys2f.dll.vir -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\vexga4me1.exe.vir -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164589.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165583.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0167606.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168611.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0170640.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212671.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231763.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233855.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0236916.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241932.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245436.exe -> Proxy.Xorpix.ba : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\a3dxx.dll.vir -> Proxy.Xorpix.m : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165571.dll -> Proxy.Xorpix.m : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0166574.dll -> Proxy.Xorpix.m : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0170635.exe -> Proxy.Xorpix.m : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0171623.dll -> Proxy.Xorpix.m : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0172628.dll -> Proxy.Xorpix.m : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0237907.dll -> Proxy.Xorpix.m : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245499.dll -> Proxy.Xorpix.m : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\core.sys.vir -> Rootkit.Agent.eq : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245479.sys -> Rootkit.Agent.eq : Cleaned with backup (quarantined). C:\QooBox\Quarantine\catchme2007-05-19_175914.51.zip/runtime2.sys -> Rootkit.Agent.ey : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\ksys.sys.vir -> Rootkit.NtRootKit : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212718.sys -> Rootkit.NtRootKit : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231810.sys -> Rootkit.NtRootKit : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233902.sys -> Rootkit.NtRootKit : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0242005.sys -> Rootkit.NtRootKit : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245467.sys -> Rootkit.NtRootKit : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@2o7[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@2o7[1].txt.dat/Documents and Settings/Owner/Cookies/owner@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@2o7[2].txt.dat/Documents and Settings/Owner/Cookies/owner@2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@buycom.122.2o7[1].txt.dat/Documents and Settings/Owner/Cookies/owner@buycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@2o7[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@2o7[2].txt.dat/Documents and Settings/Sheri/Cookies/sheri@2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@adrevolver[3].txt.dat/Documents and Settings/Kelly/Cookies/kelly@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@adrevolver[3].txt.dat/Documents and Settings/Owner/Cookies/owner@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Owner/Cookies/[removed][1].txt -> TrackingCookie.Adserver : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@advertising[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@advertising[1].txt -> TrackingCookie.Advertising : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@advertising[2].txt.dat/Documents and Settings/Owner/Cookies/owner@advertising[2].txt -> TrackingCookie.Advertising : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@atdmt[2].txt.dat/Documents and Settings/Kelly/Cookies/kelly@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@atdmt[2].txt.dat/Documents and Settings/Owner/Cookies/owner@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@atdmt[2].txt.dat/Documents and Settings/Sheri/Cookies/sheri@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@bluestreak[1].txt.dat/Documents and Settings/Owner/Cookies/owner@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Owner/Cookies/[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Kelly/Cookies/[removed][1].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@casalemedia[2].txt.dat/Documents and Settings/Kelly/Cookies/kelly@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat/Documents and Settings/Owner/Cookies/[removed][2].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@casalemedia[2].txt.dat/Documents and Settings/Owner/Cookies/owner@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@centrport[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@centrport[1].txt -> TrackingCookie.Centrport : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@centrport[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@centrport[1].txt -> TrackingCookie.Centrport : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@doubleclick[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@doubleclick[1].txt.dat/Documents and Settings/Owner/Cookies/owner@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@doubleclick[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat/Documents and Settings/Owner/Cookies/[removed][2].txt -> TrackingCookie.Falkag : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@fastclick[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@fastclick[2].txt.dat/Documents and Settings/Kelly/Cookies/kelly@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Kelly/Cookies/[removed][1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@fastclick[1].txt.dat/Documents and Settings/Owner/Cookies/owner@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@fastclick[2].txt.dat/Documents and Settings/Owner/Cookies/owner@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Owner/Cookies/[removed][1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@fastclick[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@findwhat[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat/Documents and Settings/Kelly/Cookies/[removed][2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@hitbox[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Owner/Cookies/[removed][1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat/Documents and Settings/Owner/Cookies/[removed][2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@hitbox[2].txt.dat/Documents and Settings/Owner/Cookies/owner@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Owner/Cookies/[removed][1].txt -> TrackingCookie.Information : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@mediaplex[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@mediaplex[2].txt.dat/Documents and Settings/Owner/Cookies/owner@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@mediaplex[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat/Documents and Settings/Kelly/Cookies/[removed][2].txt -> TrackingCookie.Pointroll : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat/Documents and Settings/Owner/Cookies/[removed][2].txt -> TrackingCookie.Pointroll : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@pro-market[2].txt.dat/Documents and Settings/Sheri/Cookies/sheri@pro-market[2].txt -> TrackingCookie.Pro-market : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@questionmarket[2].txt.dat/Documents and Settings/Kelly/Cookies/kelly@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@questionmarket[1].txt.dat/Documents and Settings/Owner/Cookies/owner@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@questionmarket[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@realmedia[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@realmedia[1].txt.dat/Documents and Settings/Owner/Cookies/owner@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Sheri/Cookies/[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@revenue[1].txt.dat/Documents and Settings/Owner/Cookies/owner@revenue[1].txt -> TrackingCookie.Revenue : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@edge.ru4[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@edge.ru4[1].txt.dat/Documents and Settings/Owner/Cookies/owner@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@edge.ru4[2].txt.dat/Documents and Settings/Owner/Cookies/owner@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@statcounter[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@statcounter[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@tradedoubler[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@tradedoubler[2].txt.dat/Documents and Settings/Owner/Cookies/owner@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@trafficmp[1].txt.dat/Documents and Settings/Kelly/Cookies/kelly@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@trafficmp[1].txt.dat/Documents and Settings/Owner/Cookies/owner@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\sheri@trafficmp[1].txt.dat/Documents and Settings/Sheri/Cookies/sheri@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@tribalfusion[2].txt.dat/Documents and Settings/Kelly/Cookies/kelly@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@tribalfusion[1].txt.dat/Documents and Settings/Owner/Cookies/owner@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@tribalfusion[2].txt.dat/Documents and Settings/Owner/Cookies/owner@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@valueclick[1].txt.dat/Documents and Settings/Owner/Cookies/owner@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat/Documents and Settings/Sheri/Cookies/[removed][2].txt -> TrackingCookie.Webtrendslive : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Kelly/Cookies/[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][2].txt.dat/Documents and Settings/Kelly/Cookies/[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Owner/Cookies/[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Sheri/Cookies/[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat/Documents and Settings/Kelly/Cookies/[removed][1].txt -> TrackingCookie.Zedo : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\kelly@zedo[2].txt.dat/Documents and Settings/Kelly/Cookies/kelly@zedo[2].txt -> TrackingCookie.Zedo : Cleaned. C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@zedo[2].txt.dat/Documents and Settings/Owner/Cookies/owner@zedo[2].txt -> TrackingCookie.Zedo : Cleaned. C:\QooBox\Quarantine\C\WINDOWS\sammy3.exe.vir -> Trojan.Agent : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\smpi1\lb5.exe.vir -> Trojan.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245463.exe -> Trojan.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245485.exe -> Trojan.Agent : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0212716.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP628/A0212716.dll -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0231808.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP629/A0231808.dll -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0233900.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0233900.dll -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0237917.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0237917.dll -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\drvcoh.dll.dat/WINDOWS/system32/drvcoh.dll -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\xc29[1].exe.dat/Documents and Settings/Owner/Local Settings/Temporary Internet Files/Content.IE5/8QHRK0CM/xc29[1].exe -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\winxpn32.dll.vir -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245493.dll -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\WINDOWS\KVTE66.exe -> Trojan.BHO.ab : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\explorer.exe.dat/Documents and Settings/Kelly/Local Settings/Temp/12736/explorer.exe -> Trojan.KillAV.jr : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\explorer.exe.dat/Documents and Settings/Kelly/Local Settings/Temp/4597/explorer.exe -> Trojan.KillAV.jr : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\explorer.exe.dat/Documents and Settings/Kelly/Local Settings/Temp/5219/explorer.exe -> Trojan.KillAV.jr : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\explorer.exe.dat/Documents and Settings/Owner/Local Settings/Temp/26124/explorer.exe -> Trojan.KillAV.jr : Cleaned with backup (quarantined). C:\Program Files\Ofb11\Ofb11.dll -> Trojan.OwlF.a : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154558.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154558.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154559.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154559.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154560.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154560.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154561.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154561.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154562.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154562.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154563.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154563.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154564.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154564.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154565.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154565.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154566.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154566.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154567.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154567.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154568.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154568.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0154569.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP620/A0154569.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0156586.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP622/A0156586.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0156587.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP622/A0156587.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0160592.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP624/A0160592.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0160593.dll.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP624/A0160593.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Ipwindows\UnInstall.exe.vir -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-839522115-412668190-725345543-1006\Dc342\UnInstall.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-839522115-412668190-725345543-1006\Dc346\UnInstall.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-839522115-412668190-725345543-1006\Dc347\UnInstall.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-839522115-412668190-725345543-1006\Dc349\UnInstall.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-839522115-412668190-725345543-1006\Dc350\UnInstall.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-839522115-412668190-725345543-1006\Dc593\UnInstall.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-839522115-412668190-725345543-1006\Dc594\UnInstall.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245451.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0164597.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP626/A0164597.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0164600.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP626/A0164600.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0212686.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP628/A0212686.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0231778.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP629/A0231778.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0233870.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0233870.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0237912.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0237912.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0237913.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0237913.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\a0237914.exe.dat/System Volume Information/_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}/RP630/A0237914.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\qvx5gamet2.exe.dat/WINDOWS/system32/qvx5gamet2.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\qvxga7met4.exe.dat/WINDOWS/system32/qvxga7met4.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\Enigma Software Group\SpyHunter\Backup\sqvx5gamet2.exe.dat/WINDOWS/system32/sqvx5gamet2.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP592\A0125445.vbs -> Trojan.Small : Cleaned with backup (quarantined). C:\WINDOWS\UiBLZWxseSBGb3Jhbg\o21MtqUPym13vaL1v0.vbs -> Trojan.Small : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\wincom32.sys.vir -> Trojan.Tibs.w : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164605.sys -> Trojan.Tibs.w : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245471.sys -> Trojan.Tibs.w : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\pee.exe.exe.vir -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164594.exe -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165585.exe -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168626.exe -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212683.exe -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231775.exe -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233867.exe -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241973.exe -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245441.exe -> Trojan.Tibs.y : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164565.exe -> Trojan.VB.tg : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0244347.exe -> Trojan.VB.tg : Cleaned with backup (quarantined). C:\WINDOWS\Setup89.exe -> Trojan.VB.tg : Cleaned with backup (quarantined). C:\WINDOWS\uninst108.exe -> Trojan.VB.tg : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\uni_e6h.exe.vir -> Trojan.YourEnhancement : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245477.exe -> Trojan.YourEnhancement : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\SpySheriff\heur001.dll.vir -> Trojan.Zlob : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245455.dll -> Trojan.Zlob : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\dlh9jkd1q5.exe.vir -> Worm.Nuwar : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245426.exe -> Worm.Nuwar : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164588.exe -> Worm.Zhelatin.by : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0165584.exe -> Worm.Zhelatin.by : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0167605.exe -> Worm.Zhelatin.by : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164592.exe -> Worm.Zhelatin.dy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP626\A0164593.exe -> Worm.Zhelatin.dy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168614.exe -> Worm.Zhelatin.dy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP627\A0168624.exe -> Worm.Zhelatin.dy : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\alt.exe.exe.vir -> Worm.Zhelatin.ee : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP628\A0212684.exe -> Worm.Zhelatin.ee : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP629\A0231776.exe -> Worm.Zhelatin.ee : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP630\A0233868.exe -> Worm.Zhelatin.ee : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0241974.exe -> Worm.Zhelatin.ee : Cleaned with backup (quarantined). C:\System Volume Information\_restore{59EC6C5D-70E4-4F7D-BE64-9CFBCFD72F20}\RP631\A0245440.exe -> Worm.Zhelatin.ee : Cleaned with backup (quarantined). ::Report end

MrCharlie

Post #10May 20, 2007, 1:37 AM UTC

It's going to take some time to look through all the logs, but for now please do this:

As we did before…
Right-click on the deldomains.inf file and select 'Install'

Once it is finished your Zones should be reset.

—————

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {11E2A84B-158A-3503-F04A-6FE33BE4FECB} - C:\WINDOWS\system32\dnlagqf.dll (file missing)
O2 - BHO: (no name) - {1FE0FD4A-47D4-3057-A54A-6FE33BE4FF9C} - C:\WINDOWS\system32\mws.dll (file missing)
O2 - BHO: ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - C:\PROGRA~1\Ofb11\Ofb11.dll (file missing)
O2 - BHO: (no name) - {41B3F94B-1385-3F57-AB4A-6FE33BE4FBCA} - C:\WINDOWS\system32\kggt.dll (file missing)
O2 - BHO: (no name) - {44E5A841-41D1-6052-A34A-6FE33BE4FF9C} - C:\WINDOWS\system32\tfrlhsje.dll (file missing)
O2 - BHO: (no name) - {46B3AC40-1A86-6350-A54A-6FE33BE5AECB} - C:\WINDOWS\system32\qrj.dll (file missing)
O2 - BHO: H - {5142FE17-20E6-4121-A925-A4C6385CDDAA} - C:\WINDOWS\system32\rem.dll (file missing)
O2 - BHO: IE Redirector - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\WINDOWS\system32\dnsersnd.dll (file missing)

Click on Fix Checked and exit HijackThis.

Reboot and post a fresh HijackThis log and we'll take another look. MrC

rkforan

Post #11May 20, 2007, 1:52 AM UTC

Done with that. Here's the HJT log. Computer has rebooted once in the last 3 hours (when I tried to open IE).

Kelly

Logfile of HijackThis v1.99.1
Scan saved at 8:49:21 PM, on 5/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\MotorolaDAP.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Motorola Digital Audio Player Manager (MotorolaDAP) - Motorola Inc. - C:\WINDOWS\system32\MotorolaDAP.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

MrCharlie

Post #12May 20, 2007, 1:27 PM UTC

Please do this:
Right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out
————–

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

R3 - Default URLSearchHook is missing
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone

Click on Fix Checked and exit HijackThis.

——————

Download SDFix and save it to your Desktop. (it's a small download)

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
MrC

rkforan

Post #13May 20, 2007, 2:32 PM UTC

Mr C,

Got it.

Logfile of HijackThis v1.99.1
Scan saved at 9:28:34 AM, on 5/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\MotorolaDAP.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SDFix] C:\SDFix\RunThis.bat /second
O4 - HKLM\..\RunOnce: [SDFix] C:\SDFix\RunThis.bat /second
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Motorola Digital Audio Player Manager (MotorolaDAP) - Motorola Inc. - C:\WINDOWS\system32\MotorolaDAP.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

———————————

SDFix: Version 1.84

Run by [removed]
Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service

MrCharlie

Post #14May 20, 2007, 3:03 PM UTC

Theres got to be more to that SDFix log…please run the program again.

—————–

Reboot into safe mode and……

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone

Click on Fix Checked and exit HijackThis.

Open up Internet Explorer , Tools, General Tab, reset your home page to what you want, now the Programs Tab, click Reset Web Settings
That will change everything back to the default settings.

Reboot and post a fresh HijackThis log, the log fro SDFix and we'll take another look. MrC

rkforan

Post #15May 20, 2007, 7:14 PM UTC

I reran SDFix in Safe Mode
message came up: "A subdirectory or file backupreg already exists."
Continued processing
25%
50%
75%
"unable to open the file C:\PROBA~1\INSTAL~1\{EAD4F~1\SETUP.ILG
100%

It paused and asked me to hit a key to cause reboot.
I saw a list of 4-5 files flash accross the screen just as it shutdown

I reran HJT and fixed the indicated files. I also started HJT in another account. In this account, none of the O15 or R3 items were listed.

When I went to Internet Explorer and tried to reset Web Setting I got a message that said "Unable to reset Web Settings"

I also tried to disable some of the Addin's. None of my changes would remain in effect. Everything was returned to enabled.

I also uninstalled these programs:
Yahoo Tool Bar
AOL Instant Messenger (I left AIM6)
Yahoo Instant Messenger

I tried to uninstall two items:
Yahoo! extras
Weatherbug
this did not work, I received the message "could not open install.log file"

The HJT log file after everything I did:

Logfile of HijackThis v1.99.1
Scan saved at 1:42:02 PM, on 5/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\MotorolaDAP.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SDFix] C:\SDFix\RunThis.bat /second
O4 - HKLM\..\RunOnce: [SDFix] C:\SDFix\RunThis.bat /second
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Motorola Digital Audio Player Manager (MotorolaDAP) - Motorola Inc. - C:\WINDOWS\system32\MotorolaDAP.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

————————

The SDFix Log File

SDFix: Version 1.84

Run by [removed]
Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Continuous Reboot

✨ Ask AI

Ask AI