What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijakthis Log

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I can't believe it…although I am religious about TrendMicro updates, scans, and running AdAware, my laptop is on the verge of death.

So lucky to have come across this forum…thank you SO much, in advance, for all you do. My log from today is listed below….hope you can help and also how can this occur given the protection I have installed?

Thank you,
Cindy
*********************
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\aniServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
F:\HiJackThis_v2.exe
F:\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\fpkyuxoc.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {B202653B-26C5-4549-A9E9-C96CB5D3A5B4} - C:\WINDOWS\system32\gebcd.dll
O2 - BHO: (no name) - {C33639BA-99C5-4E0F-A949-92CF0117EA71} - C:\WINDOWS\system32\fccayya.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe"
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\yiuvhujk.dll",realset
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {E9A7F56F-C40F-4928-8C6F-7A72F2A25222} (AxRUploadControl Object) - http://www.imagestation.com/common/classes….cab?v=1,0,0,37
O20 - Winlogon Notify: fccayya - C:\WINDOWS\SYSTEM32\fccayya.dll
O20 - Winlogon Notify: gebcd - C:\WINDOWS\system32\gebcd.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

–
End of file - 9653 bytes
Post #2
Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
My posts to you will be checked by one of the Forum Admins, so my replies may take a little longer.
Post #4
Hi ILoveLabs

REMOVE TRENDMICRO HIJACKTHIS

Please delete any HijackThis Folders and Files you have now.Use Add/Remove Programs and remove HijackThis. What you have now is a Beta Version and isn't ready to use.

You can get a complete installer that installs HijackThis to C:\Program Files\HijackThis, making an entry in the start menu and also providing a desktop shortcut from
here

Click on the link and select Save, save it to your desktop and double click HJTsetup.exe.

Open HijackThis and select: Do a system scan and save a log file.

When the scan is finished, Click Edit> Select All> Edit> Copy> and paste its contents here please.

You are operating your computer with multiple Anti Virus programs running in memory at once:


Anti-virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash.

If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.

There are basically two types of these programs:
On-Access and On-Demand

On-Access Scanners
As the name implies, it runs in the background all the time the PC is turned on and running. The main function of an on-access scanner is to monitor activity on your machine.

On-Demand Scanners
As the name implies, are scanners that only run when you ask them to.
Such as:
Online Scans and scanners that run on your machine but are not actively scanning your machine.

Please disable one or the other so they do not conflict.

Post back with the new Hijackthis log, please.
Post #5
Hello,
I removed 2 and installed 1.99, also I removed BitDefender.

The log follows:

********Logfile of HijackThis v1.99.1
Scan saved at 3:50:57 PM, on 5/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\aniServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe"
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\yiuvhujk.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {E9A7F56F-C40F-4928-8C6F-7A72F2A25222} (AxRUploadControl Object) - http://www.imagestation.com/common/classes….cab?v=1,0,0,37
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Post #6
To enable the viewing of Hidden files follow these steps:
  • Close all programs so that you are at your desktop.
  • Double-click on the My Computer icon (or click Start, then select My Computer)
  • Select the Tools menu and click Folder Options.
  • After the new window appears select the View tab.
  • Put a checkmark in the checkbox labeled Display the contents of system folders.
  • Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
  • Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
  • Remove the checkmark from the checkbox labeled Hide protected operating system files.
  • Press the Apply button and then the OK button and shutdown My Computer.
    Now your computer is configured to show all hidden files.

Open the HijackThis Folder. Find the file HijackThis.exe. Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.

Scan again and post a new log please.
Post #7
I only had to change the very last one ….the others were already checked/unchecked as indicated. Also renamed the file.

Log follows: **********
Logfile of HijackThis v1.99.1
Scan saved at 9:27:34 PM, on 5/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\aniServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Hijackthis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\fpkyuxoc.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {9312476D-9881-4A73-AAB0-777566875001} - C:\WINDOWS\system32\gebcd.dll
O2 - BHO: (no name) - {C33639BA-99C5-4E0F-A949-92CF0117EA71} - C:\WINDOWS\system32\fccayya.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe"
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\yiuvhujk.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {E9A7F56F-C40F-4928-8C6F-7A72F2A25222} (AxRUploadControl Object) - http://www.imagestation.com/common/classes….cab?v=1,0,0,37
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: fccayya - C:\WINDOWS\SYSTEM32\fccayya.dll
O20 - Winlogon Notify: gebcd - C:\WINDOWS\system32\gebcd.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Post #8
Hi again

Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.

In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
Post #9
Hello,
I followed the steps outlined and the txt files are posted below. Please note that after the 2nd reboot for VundoFix (fccayya.dll), I received this message from Trend-Micro:

******Trend Micro Pc-cillin Internet Security 2007 has reverted to the last known good configuration. etc……

******
VundoFix V6.4.1

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 1:56:38 PM 5/24/2007

Listing files found while scanning….

C:\WINDOWS\system32\dcbeg.bak1
C:\WINDOWS\system32\dcbeg.bak2
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\dcbeg.tmp
C:\WINDOWS\system32\fccayya.dll
C:\WINDOWS\system32\fpkyuxoc.dll
C:\WINDOWS\system32\gebcd.dll
C:\WINDOWS\system32\kjuhvuiy.ini
C:\WINDOWS\system32\kjuhvuiy.ini2
C:\WINDOWS\system32\kjuhvuiy.tmp
C:\WINDOWS\system32\yiuvhujk.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\dcbeg.bak1
C:\WINDOWS\system32\dcbeg.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\dcbeg.bak2
C:\WINDOWS\system32\dcbeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\dcbeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\dcbeg.tmp
C:\WINDOWS\system32\dcbeg.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccayya.dll
C:\WINDOWS\system32\fccayya.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\gebcd.dll
C:\WINDOWS\system32\gebcd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\kjuhvuiy.ini
C:\WINDOWS\system32\kjuhvuiy.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\kjuhvuiy.ini2
C:\WINDOWS\system32\kjuhvuiy.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\kjuhvuiy.tmp
C:\WINDOWS\system32\kjuhvuiy.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\yiuvhujk.dll
C:\WINDOWS\system32\yiuvhujk.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.4.1

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 2:21:32 PM 5/24/2007

Listing files found while scanning….

C:\WINDOWS\system32\fccayya.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\fccayya.dll
C:\WINDOWS\system32\fccayya.dll Has been deleted!

Performing Repairs to the registry.
Done!*********

Logfile of HijackThis v1.99.1
Scan saved at 2:31:31 PM, on 5/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\aniServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {95DD8A8F-657D-437A-8806-8C688B59A49C} - C:\WINDOWS\system32\gebcd.dll (file missing)
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom\apdproxy.exe"
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {E9A7F56F-C40F-4928-8C6F-7A72F2A25222} (AxRUploadControl Object) - http://www.imagestation.com/common/classes….cab?v=1,0,0,37
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Post #10
Hi ILoveLabs

Sorry Ive taken so long to get back to you, but we're almost done.

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.

First uninstall the version you have on your computer then download and install Adobe Reader 8.


Delete the older versions of Java and download the newest.

Please follow these steps to remove older version Java components.
  • Close any programmes you may have running, ESPECIALLY your web browser
  • Click Start > Control Panel.
  • Click Add/Remove Programs.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove all versions of Java.
  • Reboot your computer once all Java components are removed.
Then download the latest version of Java Runtime Environment, which is JRE6u1, and install it to your computer.


Download AVG Anti-Spyware.
  • Install AVG Anti-Spyware.
  • Launch AVG by double-clicking on the icon.
  • The program will now open to the main screen.
  • You will need to update AVG to the latest definition files.
  • At the top of the main screen click Update.
  • Then in the Manual Update section, click on Start Update.
[*]The update will start and a progress bar will show the updates being installed.


[*]When updates are completed, close AVG.

If you are having problems with the updater, you can use this link to manually update AVG.

AVG manual updates


Run a scan with AVG.
  • Click on Scanner
    • Click on the Settings tab, and set the following settings.
      • How to act
      • Click on Recommended actions, and set to Quarantine.
    • How to scan
      • Check all options.
    • Possibly unwanted software.
      • Check all options.
    • Reports
      • Check Automatically generate report after every scan.
      • Uncheck Only if threats were found.
    • What to scan
      • Check Scan every file.
  • Click on the Scan tab.
    • Click on Complete System Scan and the scan will begin.
    • When the scan has finished
    • Make sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
    • At the bottom of the window click on the Apply all Actions button.
Note: Don't save the report before you hit the Apply action button.



Close AVG Anti-Spyware.



AVG will save a report in the following location C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports


Now scan with HijackThis and post a new log in your next reply along with the AVG log.
Post #11
Thanks..I'm working on these recommendations but I have one question (forgive my ignorance)…

Then download the latest version of Java Runtime Environment, which is JRE6u1, and install it to your computer.

I don't code in Java or anything…do I have to install this? Is it a requirement for IE or something?

Thanks
Cindy
Post #12
Thanks..I'm working on these recommendations but I have one question (forgive my ignorance)…

Then download the latest version of Java Runtime Environment, which is JRE6u1, and install it to your computer.

I don't code in Java or anything…do I have to install this? Is it a requirement for IE or something?

Thanks
Cindy
Post #13
Java is used to view website content. Im not clued up on programming either but I do know each update fixes security issues that would otherwise leave your pc vulnerable to re-infection. Like Windows updates its always best to have all the latest patches.
Post #14
Hello,

As requested, the logs follow. Note that I had to run AVG a few times as the first two locked up my laptop. On the third, it finally worked.

**********
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 5:29:13 PM 5/25/2007

+ Scan result:



C:\VundoFix Backups\fccayya.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp100 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp101 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp105 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp107 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp108 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp10c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp10d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp10e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp10f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp110 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp112 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp113 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp12 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp123 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp125 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp126 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp127 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp128 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp129 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp135 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp138 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp13b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp13c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp13d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp13e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp13f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp14e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp14f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp150 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp151 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp156 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp163 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp164 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp165 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp16f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp17 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp172 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp173 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp17b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp17c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp17e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp18 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp180 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp181 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp186 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp189 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp18a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp19 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp192 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp195 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp196 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp197 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp198 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1a5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1a6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1a7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1a8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1a9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1aa -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1ab -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1b9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1ba -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1bb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1bc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1bd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1be -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1c1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1cc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1cd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1ce -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1d4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1db -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1dc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1e7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1e8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1ee -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1ef -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1f0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1f5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1f6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1fc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp1fd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp203 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp206 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp207 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp208 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp209 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp20a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp21a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp21b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp21c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp21d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp21e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp21f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp237 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp241 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp247 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp248 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp249 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp24a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp24b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp256 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp259 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp25a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp25b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp25c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp265 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp267 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp268 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp269 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp26b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp273 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp274 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp275 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp284 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp287 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp288 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp289 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp28b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp29 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp295 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp296 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp297 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp298 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp299 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp29c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp29d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp29e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2a1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2a2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2a3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2a4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2a5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2a6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2a7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2b3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2b4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2b8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2ba -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2bb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2bc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2bd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2be -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2c2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2c3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2c7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2c8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2c9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2ca -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2cb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2cf -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2d0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2d3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2d5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2d6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2d8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2db -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2dc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2dd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2de -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2e6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2e7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2e8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2e9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2ec -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2ed -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2ee -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2f2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2f3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2f4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2f9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp2fa -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp308 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp309 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp30a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp30b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp316 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp31f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp320 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp321 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp322 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp323 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp324 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp325 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp326 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp327 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp328 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp329 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp32a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp339 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp33a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp33b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp33c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp33d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp33e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp33f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp340 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp341 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp342 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp343 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp344 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp35 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp358 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp359 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp35a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp35b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp35c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp35d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp360 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp361 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp362 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp363 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp364 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp365 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp366 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp367 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp368 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp369 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp37e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp37f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp380 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp381 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp382 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp383 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp384 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp386 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp38d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp38e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp390 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp391 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp393 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp394 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp395 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp396 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp397 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp398 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp399 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp39a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp39b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp39e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp39f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3a0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3a1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3a2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3a3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3a4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3a7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3aa -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3ac -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3af -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3bb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3bc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3bd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3be -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3bf -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3c9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3cb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3cc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3cd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3ce -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3e1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3e3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3e4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3e5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3e6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3e7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3e8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3ea -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3eb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3ec -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3ed -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3f2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3f4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3f5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp3fb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp40 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp403 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp404 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp405 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp406 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp407 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp408 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp409 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp40a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp40b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp40c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp40d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp40e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp40f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp41d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp41e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp420 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp421 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp422 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp423 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp424 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp42f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp430 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp431 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp432 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp433 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp440 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp441 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp442 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp443 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp444 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp447 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp44a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp44b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp44c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp45e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp45f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp460 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp461 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp463 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp464 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp465 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp466 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp468 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp46a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp46b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp46c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp46d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp46e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp46f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp47 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp470 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp471 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp473 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp474 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp47b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp47c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp47e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp47f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp480 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp481 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp482 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp48b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp48f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp497 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp498 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp499 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp49a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp49b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp49c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp49e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4a3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4a6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4a8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4a9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4aa -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4ab -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4ac -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4ad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4b1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4b2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4b3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4c4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4c5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4c6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4c7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4c8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4ce -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4cf -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4d0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4d1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4d2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4d4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4da -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4dc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4dd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4e2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4e3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4e4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4e5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4e6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4ee -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4ef -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4f1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4f2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4f3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4f6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4f7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4f9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4fa -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4fb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4fc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4fd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp4fe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp50b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp50c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp50d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp50e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp50f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp51 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp510 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp511 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp512 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp51e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp51f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp520 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp521 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp522 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp524 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp525 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp526 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp528 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp529 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp52a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp52b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp52c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp52d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp53 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp53d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp53e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp53f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp540 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp549 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp54a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp54b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp54c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp54d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp54e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp54f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp553 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp554 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp556 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp557 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp558 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp559 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp55a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp55b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp55c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp55e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp55f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp57 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp572 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp573 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp574 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp576 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp579 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp57a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp57b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp57d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp57e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp58 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp582 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp583 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp584 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp585 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp586 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp587 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp588 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp589 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp58a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp58b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp58c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp59 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp595 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp596 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp59c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp59f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5a3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5a4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5a5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5a6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5a7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5a8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5a9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5b2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5b3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5b6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5b7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5bd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5be -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5bf -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5c0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5c1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5c2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5c3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5c4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5ca -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5cb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5cc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5cd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5ce -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5cf -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5d0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5d1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5d3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5d4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5e2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5e4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5e5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5e6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5e7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5e8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5e9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5ea -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5eb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5ec -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5ed -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5ee -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5ef -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5f0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5f3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5f5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5f6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5f7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5f8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5f9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5fb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5fc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp5ff -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp60b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp60c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp60d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp60e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp611 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp613 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp618 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp619 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp61a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp61b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp61c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp61d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp61e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp61f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp620 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp623 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp624 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp625 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp629 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp630 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp632 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp633 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp635 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp636 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp637 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp638 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp639 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp63a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp63d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp640 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp641 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp642 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp646 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp64b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp64c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp64d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp64e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp64f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp651 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp652 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp65f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp66 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp660 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp661 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp662 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp664 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp665 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp666 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp66f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp674 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp675 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp678 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp679 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp67a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp67b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp67d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp67e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp67f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp68 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp680 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp681 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp72 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp7d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp7e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp8c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp8d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp8e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp99 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp9a -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp9b -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp9c -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp9d -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp9e -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmp9f -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpa0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpa1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpaf -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpb4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpb5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpb8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpbb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpbc -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpbd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpbe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpc6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpc7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpc8 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpc9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpca -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpcb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpcf -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpd0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpd5 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpd6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpd7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpd9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpdb -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpdf -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpe0 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpe1 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpe2 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpe3 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpe4 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpe6 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpe7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpec -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpf7 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpf9 -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpfd -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpfe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\tmpff -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\Cindy\Cookies\cindy@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Cindy\Cookies\cindy@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Cindy\Cookies\cindy@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Cindy\Cookies\cindy@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Cindy\Cookies\[removed][2].txt -> TrackingCookie.Cnn : Cleaned.
C:\Documents and Settings\Cindy\Cookies\cindy@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Cindy\Cookies\cindy@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Cindy\Cookies\[removed][1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Cindy\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned.


::Report end



**********************
Logfile of HijackThis v1.99.1
Scan saved at 5:34:27 PM, on 5/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\aniServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\Program Files\Hijackthis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {95DD8A8F-657D-437A-8806-8C688B59A49C} - C:\WINDOWS\system32\gebcd.dll (file missing)
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {E9A7F56F-C40F-4928-8C6F-7A72F2A25222} (AxRUploadControl Object) - http://www.imagestation.com/common/classes….cab?v=1,0,0,37
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Post #15
Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):


O2 - BHO: (no name) - {95DD8A8F-657D-437A-8806-8C688B59A49C} - C:\WINDOWS\system32\gebcd.dll (file missing)




WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

Open AVG Anti-Spyware again and click on Infections. This will show you all the quarantined files. Press Select All then Remove. Then close AVG.

Run HijackThis and post a new log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI