[Resolved]Baseline Popups Interupting My Work

Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Hi tinymight

You have got a couple of not so good programs on your pc. We will remove them first then take a closer look. Ill remove most of the Active X's too. Most are okay and can be replaced next time you visit the site you got them.

End malicious processes: (if they are present)

• Press the CTRL+ALT+DEL keys simultaneously to open Task Manager
• Click on the Processes tab to show running processes
• Find Weather.exe
  and click on it
• Click End Process
• Close Task Manager

Remove programs from Add/Remove Programs List

• Please go to:
• Start
• Control Panel
• Add/Remove Programs

Find and remove these programs (if they are present)

• AWS
• My Web Search

Navigate to and delete the following folders (if they are present):

Folders:

• C:\Program Files\AWS
• C:\Program Files\MyWebSearch

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O2 - BHO: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - (no file)
O2 - BHO: (no name) - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - (no file)
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} -
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} -
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} -
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} -
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} -
O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} -
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} -
O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} -
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} -
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} -
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} -
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} -
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Plug-in 1.5.0_09) -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make sure that the following are selected:
  • Scan using the following Anti-Virus database:
    
    + Extended(If available otherwise Standard)
  • Scan Options:
    
    + Scan Archives
    + Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button
• Save the file to your desktop.
• Copy and paste that information in your next post.

I have followed your instructions exactly, and even deleted the weatherbug files. I must tell you that I have been using weatherbug on my computer for about 4 years now. It is a program that came with the computer that gives me the weather right on my desktop. I use it all the time. Can I reinstall the program once this is all done? Or is there something wrong with it that I don't know about? Here is the info from the kaspersky program. KASPERSKY ONLINE SCANNER REPORT Wednesday, July 18, 2007 10:03:48 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 19/07/2007 Kaspersky Anti-Virus database records: 364970 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ G:\ Scan Statistics Total number of scanned objects 145395 Number of viruses found 35 Number of infected objects 89 Number of suspicious objects 0 Duration of the scan process 02:17:09 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\31a43f3647765c7cc49f8a11d2a18f7e_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3a03ede81718ff07f17e5469ad7b2894_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\604438aa1ce01ced7aba648830bd9a95_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6629603575de9af3512f5db8116a2649_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7c10f6085a2c9d9ad53e116d2f512b8d_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8be03fbb6705ea75fcc8090d59a9241a_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bd088e4918950653230c2df3a30b2ace_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea563f5ed0b8ea72081a19b9b561dd25_507411ca-efc8-43fe-8560-fc92c576bab3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea563f5ed0b8ea72081a19b9b561dd25_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f6e9bda0fc861022cdc83da6b8ab8583_8fb5376b-2ed7-4947-a7d1-2c00fa3a6fb1 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\STOPzilla!\Targets.Db Object is locked skipped C:\Documents and Settings\All Users\Application Data\STOPzilla!\userdata.db Object is locked skipped C:\Documents and Settings\All Users\Application Data\STOPzilla!\zilla5.log Object is locked skipped C:\Documents and Settings\Default User\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01/data0007 Infected: Trojan-Downloader.Win32.Zlob.ate skipped C:\Documents and Settings\Default User\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 NSIS: infected - 1 skipped C:\Documents and Settings\Default User\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 UPX: infected - 1 skipped C:\Documents and Settings\Default User\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 PE_Patch.UPX: infected - 1 skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Application Data\NSS PKI Store\AOL\certS.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\NSS PKI Store\AOL\keyS.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\NSS PKI Store\AOL\log.0000000001 Object is locked skipped C:\Documents and Settings\Owner\Application Data\NSS PKI Store\AOL\secmodS.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\NSS PKI Store\AOL\__db.001 Object is locked skipped C:\Documents and Settings\Owner\Application Data\NSS PKI Store\AOL\__db.002 Object is locked skipped C:\Documents and Settings\Owner\Application Data\NSS PKI Store\AOL\__db.003 Object is locked skipped C:\Documents and Settings\Owner\Application Data\NSS PKI Store\AOL\__db.004 Object is locked skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-40178f99/Counter.class Infected: Trojan.Java.ClassLoader.i skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-40178f99/VerifierBug.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-40178f99/Beyond.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-40178f99 ZIP: infected - 3 skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-72c21aa0/Counter.class Infected: Trojan.Java.ClassLoader.i skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-72c21aa0/VerifierBug.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-72c21aa0/Beyond.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-72c21aa0 ZIP: infected - 3 skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\41\529ea6e9-22092cdf/OP.class Infected: Trojan-Downloader.Java.OpenStream.ab skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\41\529ea6e9-22092cdf ZIP: infected - 1 skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-4eb2842d.zip/Counter.class Infected: Trojan.Java.ClassLoader.i skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-4eb2842d.zip/VerifierBug.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-4eb2842d.zip/Beyond.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-4eb2842d.zip ZIP: infected - 3 skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\OP.jar-4b9c0e39-29d27228.zip/OP.class Infected: Trojan-Downloader.Java.OpenStream.ab skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\OP.jar-4b9c0e39-29d27228.zip ZIP: infected - 1 skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01/data0007 Infected: Trojan-Downloader.Win32.Zlob.ate skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 NSIS: infected - 1 skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 UPX: infected - 1 skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 PE_Patch.UPX: infected - 1 skipped C:\Documents and Settings\Owner\Local Settings\Application Data\SITEguard\siteguard.db Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\AntiPhishing\FDE76B9D-4657-4B28-AE87-04EFD23D4EB6.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DF3AC.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DFA87.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped C:\Downloads\DinerDashFotGSetup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped C:\hp\region\EN_US-ie.reg Infected: Trojan.WinREG.StartPage skipped C:\Program Files\Internet Explorer\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\Switcheroo Deluxe\WinUpdtInstPack.exe Infected: not-a-virus:AdWare.Win32.WinAD.aq skipped C:\RECYCLER\S-1-5-21-3095613367-2923200350-3259968406-1003\Dc119\WeatherBug\Install\WxBugSetup60b6.04.0.9m.EXE/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.MyWay.j skipped C:\RECYCLER\S-1-5-21-3095613367-2923200350-3259968406-1003\Dc119\WeatherBug\Install\WxBugSetup60b6.04.0.9m.EXE WiseSFX: infected - 1 skipped C:\RECYCLER\S-1-5-21-3095613367-2923200350-3259968406-1003\Dc119\WeatherBug\Install\WxBugSetup60b6.04.0.9m.EXE WiseSFX Dropper: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018836.dll Infected: not-a-virus:AdWare.Win32.HotBar.ca skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018839.dll Infected: not-a-virus:AdWare.Win32.HotBar.bz skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018842.dll Infected: not-a-virus:AdWare.Win32.HotBar.ca skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018843.exe/data0012 Infected: not-a-virus:AdWare.Win32.180Solutions.ba skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018843.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018844.exe Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP119\A0018879.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP131\A0020105.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP131\A0020106.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP131\A0020107.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP136\A0020278.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.NaviPromo.ao skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP136\A0020278.exe/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.ao skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP136\A0020278.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP140\A0021466.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP140\A0021467.DLL Infected: not-a-virus:AdWare.Win32.FunWeb.e skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP166\A0024755.exe Infected: not-a-virus:AdWare.Win32.NaviPromo.gen skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP175\A0025307.exe Infected: not-a-virus:Downloader.Win32.WinFixer.z skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP175\change.log Object is locked skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014276.DLL Infected: not-a-virus:AdWare.Win32.MyWay.j skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014277.EXE Infected: not-a-virus:AdWare.Win32.MyWay.j skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014278.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ao skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014281.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014283.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014284.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014285.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014286.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014287.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014288.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014289.SCR Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014290.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014291.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014292.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014293.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014294.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014295.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014297.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014298.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014300.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014302.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014303.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014304.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014306.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014307.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP79\A0014310.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\win32k.sys.000 Object is locked skipped C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped C:\WINDOWS\cpbrkpie.ocx Infected: not-a-virus:AdWare.Win32.Coupons.h skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Downloaded Program Files\CONFLICT.1\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.a skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\B23E4567d01 Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01/data0007 Infected: Trojan-Downloader.Win32.Zlob.ate skipped C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 NSIS: infected - 1 skipped C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 UPX: infected - 1 skipped C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DD612672d01 PE_Patch.UPX: infected - 1 skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\msCMTsrvc.exe Infected: Trojan-Downloader.Win32.Presario skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\NSIS_Install_IGB.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.NaviPromo.ao skipped C:\WINDOWS\Temp\NSIS_Install_IGB.exe/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.ao skipped C:\WINDOWS\Temp\NSIS_Install_IGB.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\sqlite_I1pJYYQu6C6ulhn Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Hello tinymight

Download AVG Anti-Spyware.

• Install AVG Anti-Spyware.
• Launch AVG by double-clicking on the icon.
• The program will now open to the main screen.
• You will need to update AVG to the latest definition files.
• At the top of the main screen click Update.
• Then in the Manual Update section, click on Start Update.

[*]The update will start and a progress bar will show the updates being installed.

[*]When updates are completed, close AVG.

If you are having problems with the updater, you can use this link to manually update AVG.
AVG manual updates

Run a scan with AVG.

• Click on Scanner
  • Click on the Settings tab, and set the following settings.
    • How to act
    • Click on Recommended actions, and set to Quarantine.
  • How to scan
    • Check all options.
  • Possibly unwanted software.
    • Check all options.
  • Reports
    • Uncheck Automatically generate report after every scan. <– there is a bug with this version. Do this to get a report.
    • Uncheck Only if threats were found.
  • What to scan
    • Check Scan every file.
• Click on the Scan tab.
  • Click on Complete System Scan and the scan will begin.
  • When the scan has finished
  • Make sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
  • At the bottom of the window click on the Apply all Actions button.

Note: Don't save the report before you hit the Apply action button.

Close AVG Anti-Spyware.

AVG will save a report in the following location C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports

After I am finished scanning with AVG am I supposed to post a copy of the report here? Also I am still wondering why you had me delete my Weatherbug program? Like I said before, I have been using that program for 4 years now and love it. It keeps me up to date on the weather.

Hi tinymight

My apologies, I meant to post this,as Weatherbug is an optional choice. Ive been so used to removing it, I got ahead of myself.

WeatherBug is a system tray icon that offers weather information and includes built-in ads. WeatherBug is controlled by AWS Convergence Technologies (weatherbugmedia.com). There is some controversy over whether WeatherBug should be targeted by anti-parasite software. AWS strongly deny their software is ‘spyware’, and by the definition used here, it is not, as it does not leak information back to its controlling servers. However, WeatherBug has in the past been silently installed by the FavoriteMan parasite and Freeze.com screensavers, and more recently has been bundled by software such as AIM and Blubster. This makes it ‘unsolicited’, and since it is installed to raise money for its creators through the built-in ads it is certainly ‘commercial’. So it does meet the definition for ‘parasite’: unsolicited commercial software. It is nonetheless listed as a borderline case because it is not overtly harmful and many people do install it deliberately. WeatherBug bundles the MySearch parasite in its standalone distribution and has in the past, installed Gator and SVAPlayer.

I recommend that you uninstall WeatherBugand choose one of these alternatives:
Weather Pulse
Weather Watcher
or
Get mozilla Firefox and then get FORECASTFOX!!!
or check the weather at these websites:
Weather Street: US Weather
Intellicast

Gator is one of the problem files you have on your computer.


Could you post that AVG report?

Thank you for the informaiton on weatherbug. AVG is going to take a while to run so I will start it when I get ready to leave out of town in a little bit. I will be back later this evening and will post it then. Thank you Cleo

Finished before I had to leave. Here it is.. + Created at: 10:13:02 AM 7/19/2007 + Scan result: C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018844.exe -> Adware.180Solutions : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP175\A0025307.exe -> Adware.AvSystemcare : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP175\A0025209.exe -> Adware.ClickSpring : Cleaned with backup (quarantined). C:\WINDOWS\cpbrkpie.ocx -> Adware.Coupons : Cleaned with backup (quarantined). C:\Documents and Settings\Default User\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DAF1E752d01 -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DAF1E752d01 -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\DAF1E752d01 -> Adware.DriveCleaner : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP140\A0021467.DLL -> Adware.FunWeb : Cleaned with backup (quarantined). C:\Program Files\HQ Codec -> Adware.Generic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018836.dll -> Adware.HotBar : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018838.exe -> Adware.Hotbar : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018839.dll -> Adware.HotBar : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018842.dll -> Adware.HotBar : Cleaned with backup (quarantined). C:\Downloads\DinerDashFotGSetup-dm[1].exe -> Adware.Trymedia : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-3095613367-2923200350-3259968406-1003\Dc119\WeatherBug\Weather.exe -> Adware.WeatherBug : Cleaned with backup (quarantined). C:\Program Files\Switcheroo Deluxe\WinUpdtInstPack.exe -> Adware.WinAD : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP117\A0018840.dll -> Adware.Zango : Cleaned with backup (quarantined). C:\WINDOWS\system32\msCMTsrvc.exe -> Downloader.Presario : Cleaned with backup (quarantined). C:\Program Files\eGames\MahJongg Master 3\assets\demos.htm -> Dropper.Small.w : Cleaned with backup (quarantined). C:\hp\region\EN_US-ie.reg -> Hijacker.StartPage : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.Downloader.Win32.PopCap.a : Cleaned with backup (quarantined). C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\Cache\B23E4567d01 -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\Documents and Settings\Default User\Cookies\owner@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned. :mozilla.29:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.29:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.30:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.6:C:\Documents and Settings\Default User\Application Data\Mozilla\Profiles\default\xyndfcul.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.6:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\xyndfcul.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.6:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Profiles\default\xyndfcul.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.7:C:\Documents and Settings\Default User\Application Data\Mozilla\Profiles\default\xyndfcul.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.7:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\xyndfcul.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.7:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Profiles\default\xyndfcul.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. :mozilla.5:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.6:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.6:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.6:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.7:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.7:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][2].txt -> TrackingCookie.Burstbeacon : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][1].txt -> TrackingCookie.Information : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned. C:\Documents and Settings\Owner\Cookies\[removed][2].txt -> TrackingCookie.Netflame : Cleaned. :mozilla.47:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.47:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.48:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.48:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.48:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.49:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@real[2].txt -> TrackingCookie.Real : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@realmedia[2].txt -> TrackingCookie.Realmedia : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@revenue[2].txt -> TrackingCookie.Revenue : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@revsci[1].txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@spylog[2].txt -> TrackingCookie.Spylog : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned. C:\Documents and Settings\Default User\Cookies\[removed][2].txt -> TrackingCookie.Starware : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Owner\Cookies\owner@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned. :mozilla.62:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.62:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.63:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.63:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.63:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.64:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.64:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.64:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.65:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.65:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.65:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.66:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.66:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.66:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.67:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.67:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.67:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.68:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.68:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.68:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.69:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\5v7f32er.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Documents and Settings\Default User\Cookies\owner@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\QooBox\Quarantine\C\WINDOWS\system32\wintsvit.exe.vir -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{FDF7E1BD-3514-4652-A0DC-09D8FF2520E1}\RP175\A0025292.exe -> Trojan.Small : Cleaned with backup (quarantined). ::Report end

Hello tinymight Could you post a new HijackThis log and let me know how your computer is behaving now?

Hi tinymight


Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

• Close any programmes you may have running, ESPECIALLY your web browser
• Click Start > Control Panel.
• Click Add/Remove Programs.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove all versions of Java.
• Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u2, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable
  and reenable system restore to make sure there are no infected files found in a restore point.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Re-enable system restore with instructions from tutorial above
  
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine.
  This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
  (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
  Without a firewall your computer is succeptible to being hacked and taken over.
  I am very serious about this and see it happen almost every day with my clients.
  Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
  This will ensure your computer has always the latest security updates available installed on your computer.
  If there are new updates to install, install them immediately, reboot your computer, and revisit the site
  until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
  This will provide realtime spyware & hijacker protection on your computer alongside your virus protection.
  You should also scan your computer with this program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
  
• Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
  settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
  
  Using IE-SPYAD to help block unwanted sites and activities
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly.
  Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php