What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] MSN messenger virus

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hey folks, my Uncle opened a zipped file he got on his msn from a contact. Now he has the virus..
The virus sends out messages to all his contacts saying "sorry about all the trouble, I finally fixed the pic.. " and then sends a file along with the message. The message changes everytime!!

He couldn't even get Hijack This to save his logfile, so he emailed the screen shot to me.
Thanks for your input.
📎scan.jpg

He finally was able to get it to work….someone put ThreatFire AV program on it……

Logfile of HijackThis v1.99.1
Scan saved at 1:47:30 AM, on 2/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\twain_32\paprport\3100b\flatbed.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Drivers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07514F83-D646-4119-AAE0-A0C6E857B000} - C:\WINDOWS\system32\geeba.dll (file missing)
O2 - BHO: {30bffce6-8e57-cd0a-1404-113c19446e52} - {25e64491-c311-4041-a0dc-75e86ecffb03} - C:\WINDOWS\system32\cwytlmfv.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {98663E21-9CCE-4CF6-863C-911A9523A66F} - C:\WINDOWS\system32\awtutur.dll (file missing)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\obygkaxs.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PP3100B] C:\WINDOWS\twain_32\paprport\3100b\flatbed.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?ef24ef84dcfe492b8303ed7cd914aee4
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?ef24ef84dcfe492b8303ed7cd914aee4
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: awtutur - awtutur.dll (file missing)
O20 - Winlogon Notify: obygkaxs - obygkaxs.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Print Spooler Service (ptzeuqloujlp) - Unknown owner - C:\WINDOWS\system32\fotqzzjmqxp.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
Post #2
Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.


1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again afterwards before connecting to the net


2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
  • If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review


Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.
Post #3
Here's the logfile from combofix

ComboFix 08-02.05.3 - Randy 2008-02-09 20:14:41.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.124 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\Randy\Application Data\macromedia\Flash Player\#SharedObjects\UWN9D7ST\www.broadcaster.com
C:\Documents and Settings\Randy\Application Data\macromedia\Flash Player\#SharedObjects\UWN9D7ST\www.broadcaster.com\played_list.sol
C:\Documents and Settings\Randy\Application Data\macromedia\Flash Player\#SharedObjects\UWN9D7ST\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\Randy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Randy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\WINDOWS\system32\abeeg.ini
C:\WINDOWS\system32\abeeg.ini2
C:\WINDOWS\system32\obygkaxs.dllbox
C:\WINDOWS\system32\xiirxcte.ini

—– BITS: Possible infected sites —–

hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 )))))))))))))))))))))))))))))))
.

2008-02-09 20:13 . 2008-02-09 20:13 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-03 20:08 . 2008-02-03 20:12 d——– C:\Program Files\BearShare
2008-02-03 20:08 . 2008-02-07 00:33 d——– C:\My Downloads
2008-02-01 10:19 . 2008-02-01 10:19 268 –ah—– C:\sqmdata00.sqm
2008-02-01 10:19 . 2008-02-01 10:19 244 –ah—– C:\sqmnoopt00.sqm
2008-01-31 23:22 . 2008-02-09 20:12 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-30 23:21 . 2008-01-30 23:21 d——– C:\Documents and Settings\All Users\Application Data\PC Tools
2008-01-30 23:21 . 2007-12-20 11:13 12,608 –a—— C:\WINDOWS\system32\drivers\TfKbMon.sys
2008-01-30 14:08 . 2008-01-30 14:08 d——– C:\Program Files\RogueRemover FREE
2008-01-30 13:39 . 2008-01-30 13:39 d——– C:\Program Files\CCleaner
2008-01-30 13:34 . 2008-01-30 13:34 d——– C:\Documents and Settings\Administrator\Application Data\Paretologic
2008-01-30 13:24 . 2008-01-30 13:24 d——– C:\Documents and Settings\Administrator\Application Data\Talkback
2008-01-30 13:16 . 2008-01-30 13:16 d——– C:\Program Files\CleanUp!
2008-01-30 13:15 . 2008-01-30 14:06 d——– C:\Documents and Settings\Administrator\Application Data\U3
2008-01-29 22:49 . 2007-08-01 21:47 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-14 16:10 ——— d—–w C:\Documents and Settings\Randy\Application Data\Roxio
2008-01-03 16:02 180,224 —-a-w C:\WINDOWS\UninstallWSST.exe
2007-12-28 22:10 ——— d—–w C:\Documents and Settings\LocalService\Application Data\Roxio
2007-12-28 22:10 ——— d—–w C:\Documents and Settings\All Users\Application Data\Roxio
2007-12-28 22:08 ——— d—–w C:\Program Files\Roxio
2007-12-28 21:52 ——— d—–w C:\Program Files\Common Files\SureThing Shared
2007-12-28 21:51 ——— d—–w C:\Program Files\Common Files\Sonic Shared
2007-12-28 21:51 ——— d—–w C:\Program Files\Common Files\Roxio Shared
2007-12-28 21:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Sonic
2007-09-11 14:08 13 —h–w C:\Documents and Settings\All Users\Application Data\1ÌØ13.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07514F83-D646-4119-AAE0-A0C6E857B000}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25e64491-c311-4041-a0dc-75e86ecffb03}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-07-03 08:51 180269]
"PP3100B"="C:\WINDOWS\twain_32\paprport\3100b\flatbed.exe" [1998-05-07 16:04 33280]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-13 20:10 409600]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 11:22 221184]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-07-26 13:48 3305472]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtutur]
awtutur.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\obygkaxs]
obygkaxs.dll

R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2007-02-08 20:05]
R3 SNPP106;PC Camera (6029 CIF);C:\WINDOWS\system32\DRIVERS\snpp106.sys [2003-04-09 10:44]
S0 TfFsMon;TfFsMon;C:\WINDOWS\system32\drivers\TfFsMon.sys []
S0 TfSysMon;TfSysMon;C:\WINDOWS\system32\drivers\TfSysMon.sys []
S2 ptzeuqloujlp;Print Spooler Service;C:\WINDOWS\system32\fotqzzjmqxp.exe []
S3 TfNetMon;TfNetMon;C:\WINDOWS\system32\drivers\TfNetMon.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-02-10 01:07:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 20:19:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
.
**************************************************************************
.
Completion time: 2008-02-09 20:21:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-10 01:21:47
.
2008-01-30 13:56:12 — E O F —
Post #4
And here is a new hijack file

Logfile of HijackThis v1.99.1
Scan saved at 8:24:28 PM, on 2/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\twain_32\paprport\3100b\flatbed.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Drivers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07514F83-D646-4119-AAE0-A0C6E857B000} - blank (file missing)
O2 - BHO: {30bffce6-8e57-cd0a-1404-113c19446e52} - {25e64491-c311-4041-a0dc-75e86ecffb03} - blank (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PP3100B] C:\WINDOWS\twain_32\paprport\3100b\flatbed.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?ef24ef84dcfe492b8303ed7cd914aee4
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?ef24ef84dcfe492b8303ed7cd914aee4
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: awtutur - awtutur.dll (file missing)
O20 - Winlogon Notify: obygkaxs - obygkaxs.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Print Spooler Service (ptzeuqloujlp) - Unknown owner - C:\WINDOWS\system32\fotqzzjmqxp.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
Post #5
Close all programs leaving only HijackThis running. Place a check against each of the following,
O2 - BHO: (no name) - {07514F83-D646-4119-AAE0-A0C6E857B000} - blank (file missing)
O2 - BHO: {30bffce6-8e57-cd0a-1404-113c19446e52} - {25e64491-c311-4041-a0dc-75e86ecffb03} - blank (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O20 - Winlogon Notify: awtutur - awtutur.dll (file missing)
O20 - Winlogon Notify: obygkaxs - obygkaxs.dll (file missing)
Click on Fix Checked when finished and exit HijackThis.

——————————————————————


Click HERE to run Panda's ActiveScan

* You need to use IE to run this scan
* Once you are on the Panda site click the Scan your PC button
* A new window will open…click the Check Now button
* Enter your Country
* Enter your State/Province
* Enter your e-mail address and click send
* Select either Home User or Company
* Click the big Scan Now button
* If it wants to install an ActiveX component allow it
* It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
* When download is complete, click on My Computer to start the scan
* When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
Post #6
thanks little eagle…here is the new logfile from hijack this


Logfile of HijackThis v1.99.1
Scan saved at 10:03:33 AM, on 2/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Drivers\HijackThis.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?ef24ef84dcfe492b8303ed7cd914aee4
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?ef24ef84dcfe492b8303ed7cd914aee4
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Print Spooler Service (ptzeuqloujlp) - Unknown owner - C:\WINDOWS\system32\fotqzzjmqxp.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
Post #7

Click HERE to run Panda's ActiveScan

* You need to use IE to run this scan
* Once you are on the Panda site click the Scan your PC button
* A new window will open…click the Check Now button
* Enter your Country
* Enter your State/Province
* Enter your e-mail address and click send
* Select either Home User or Company
* Click the big Scan Now button
* If it wants to install an ActiveX component allow it
* It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
* When download is complete, click on My Computer to start the scan
* When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Post #8
Thanks again Here is the Panda Scan stuff Incident Status Location Adware:adware/savenow Not disinfected Windows Registry Adware:adware/seekmo Not disinfected Windows Registry Adware:adware/abox Not disinfected Windows Registry Dialer:dialer.asl Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1426AC5-8CE5-4A00-B71E-011D35709AC6} Spyware:Cookie/Bilbo.counted Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@bilbo_counted(1).txt Spyware:Cookie/Bilbo.counted Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@bilbo_counted(2).txt Spyware:Cookie/Bilbo.counted Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@bilbo_counted(3).txt Spyware:Cookie/Bilbo.counted Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@bilbo_counted(4).txt Spyware:Cookie/Bilbo.counted Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@bilbo_counted(5).txt Spyware:Cookie/Bilbo.counted Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@bilbo_counted.txt Spyware:Cookie/Ccbill Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@ccbill(1).txt Spyware:Cookie/Ccbill Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@ccbill(2).txt Spyware:Cookie/Ccbill Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@ccbill(3).txt Spyware:Cookie/Ccbill Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@ccbill(4).txt Spyware:Cookie/Ccbill Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@ccbill(5).txt Spyware:Cookie/Clickbank Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Hitslink Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@counter_hitslink(1).txt Spyware:Cookie/Hitslink Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@counter_hitslink(2).txt Spyware:Cookie/Hitslink Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@counter_hitslink.txt Spyware:Cookie/Euniverseads Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Go Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/GoClick Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Hypercount Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/LinkExchange Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Outster Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@outster(1).txt Spyware:Cookie/Outster Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Overture Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/PayCounter Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Peel Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Mircx Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@pop_mircx.txt Spyware:Cookie/Preferences Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@preferences(1).txt Spyware:Cookie/Preferences Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@preferences(3).txt Spyware:Cookie/Preferences Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@server_iad_liveperson(1).txt Spyware:Cookie/Com.com Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@terra_com(1).txt Spyware:Cookie/Com.com Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@terra_com(2).txt Spyware:Cookie/Com.com Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@terra_com.txt Spyware:Cookie/Traffic Marketplace Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Tribalfusion Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Gator Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpdp_gator(1).txt Spyware:Cookie/Gator Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpdp_gator(2).txt Spyware:Cookie/Gator Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpdp_gator.txt Spyware:Cookie/WebPower Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpower(1).txt Spyware:Cookie/WebPower Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpower(2).txt Spyware:Cookie/WebPower Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpower(3).txt Spyware:Cookie/WebPower Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpower(4).txt Spyware:Cookie/WebPower Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpower(5).txt Spyware:Cookie/WebPower Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpower(6).txt Spyware:Cookie/WebPower Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@webpower(8).txt Spyware:Cookie/WebPower Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Golden Palace Online Casino Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@www_goldenpalace.txt Spyware:Cookie/Luckynugget Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@www_luckynugget.txt Spyware:Cookie/Toplist Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@www_toplist(1).txt Spyware:Cookie/Toplist Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@www_toplist(2).txt Spyware:Cookie/Toplist Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\randy@www_toplist.txt Spyware:Cookie/Xiti Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Zedo Not disinfected C:\Copy of DON'T TOUCH\WINDOWS\Profiles\manicman\Cookies\[removed] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Randy\Application Data\Mozilla\Firefox\Profiles\l6ign3dg.default\cookies.txt[.com.com/] Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Randy\Application Data\Mozilla\Firefox\Profiles\l6ign3dg.default\cookies.txt[.adultfriendfinder.com/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Randy\Cookies\randy@atdmt[2].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Randy\Desktop\ComboFix.exe[327882R2FWJFW\nircmd.com] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Randy\Desktop\ComboFix.exe[327882R2FWJFW\nircmd.cfexe] Spyware:Spyware/Virtumonde Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025124.dll Spyware:Spyware/Virtumonde Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025125.exe Virus:Bck/SmtpServer.G Disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025126.exe Spyware:Spyware/Virtumonde Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025127.dll Virus:Bck/SmtpServer.G Disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025128.exe Spyware:Spyware/Virtumonde Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025129.dll Spyware:Spyware/Virtumonde Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025130.dll Spyware:Spyware/Virtumonde Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025131.dll Spyware:Spyware/Virtumonde Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025132.dll Adware:Adware/MalwareAlarm Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025133.exe Adware:Adware/MalwareAlarm Not disinfected C:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025134.exe Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\Nircmd.exe Spyware:Cookie/RealMedia Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.realmedia.com/] Spyware:Cookie/Zedo Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.zedo.com/] Spyware:Cookie/Statcounter Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.statcounter.com/] Spyware:Cookie/YieldManager Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Serving-sys Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[bs.serving-sys.com/] Spyware:Cookie/888 Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.888.com/] Spyware:Cookie/Maxserving Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.maxserving.com/] Spyware:Cookie/Belnk Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.belnk.com/] Spyware:Cookie/onestat.com Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[stat.onestat.com/] Spyware:Cookie/Belnk Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.ath.belnk.com/] Spyware:Cookie/WebPower Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.webpower.com/] Spyware:Cookie/WinFixer Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.winfixer.com/] Spyware:Cookie/WUpd Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.revenue.net/] Spyware:Cookie/FortuneCity Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.fortunecity.com/] Spyware:Cookie/Screensavers Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.i.screensavers.com/] Spyware:Cookie/Apmebf Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.apmebf.com/] Spyware:Cookie/Seeq Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[www48.seeq.com/] Spyware:Cookie/SAHAgent Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[www.shopathomeselect.com/] Spyware:Cookie/OfferOptimizer Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.offeroptimizer.com/] Spyware:Cookie/Locator Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\dt81kg5c.default\cookies.txt[.locators.com/] Spyware:Cookie/Overture Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.overture.com/] Spyware:Cookie/Statcounter Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.statcounter.com/] Spyware:Cookie/RealMedia Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.realmedia.com/] Spyware:Cookie/Zedo Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.zedo.com/] Spyware:Cookie/Atlas DMT Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.atdmt.com/] Spyware:Cookie/Zedo Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.zedo.com/] Spyware:Cookie/Zedo Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[c5.zedo.com/] Spyware:Cookie/Atlas DMT Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.atdmt.com/] Spyware:Cookie/Doubleclick Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.doubleclick.net/] Spyware:Cookie/AdDynamix Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.ads.addynamix.com/] Spyware:Cookie/YieldManager Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Adrevolver Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.adrevolver.com/] Spyware:Cookie/Atwola Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.atwola.com/] Spyware:Cookie/Falkag Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.as-eu.falkag.net/] Spyware:Cookie/adultfriendfinder Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.adultfriendfinder.com/] Spyware:Cookie/onestat.com Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[stat.onestat.com/] Spyware:Cookie/FastClick Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.fastclick.net/] Spyware:Cookie/Falkag Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.as-us.falkag.net/] Spyware:Cookie/Tribalfusion Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.tribalfusion.com/] Spyware:Cookie/QuestionMarket Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.questionmarket.com/] Spyware:Cookie/Advertising Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.advertising.com/] Spyware:Cookie/Maxserving Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.maxserving.com/] Spyware:Cookie/Advnt Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[www.advnt01.com/] Spyware:Cookie/bravenetA Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.bravenet.com/] Spyware:Cookie/BurstNet Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.burstnet.com/] Spyware:Cookie/cs.sexcounter Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.cs.sexcounter.com/] Spyware:Cookie/Belnk Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.belnk.com/] Spyware:Cookie/Traffic Marketplace Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.trafficmp.com/] Spyware:Cookie/Bluestreak Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.bluestreak.com/] Spyware:Cookie/Ccbill Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.ccbill.com/] Spyware:Cookie/PayCounter Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.paycounter.com/] Spyware:Cookie/Rn11 Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.rn11.com/] Spyware:Cookie/Mammamediasolutions Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.targetnet.com/] Spyware:Cookie/Adserver Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.z1.adserver.com/] Spyware:Cookie/888 Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.888.com/] Spyware:Cookie/SexList Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.sexlist.com/] Spyware:Cookie/Casalemedia Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.casalemedia.com/] Spyware:Cookie/Com.com Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.com.com/] Spyware:Cookie/Serving-sys Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.serving-sys.com/] Spyware:Cookie/WebtrendsLive Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[statse.webtrendslive.com/] Spyware:Cookie/BurstBeacon Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[www.burstbeacon.com/] Spyware:Cookie/HotLog Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.hotlog.ru/] Spyware:Cookie/Yadro Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.yadro.ru/] Spyware:Cookie/PointRoll Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.ads.pointroll.com/] Spyware:Cookie/Mediaplex Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.mediaplex.com/] Spyware:Cookie/Falkag Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[sel.as-eu.falkag.net/] Spyware:Cookie/Toplist Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.toplist.cz/] Spyware:Cookie/Server.iad.Liveperson Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[server.iad.liveperson.net/hc/47045278] Spyware:Cookie/Server.iad.Liveperson Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[server.iad.liveperson.net/] Spyware:Cookie/Xiti Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.xiti.com/] Spyware:Cookie/WUpd Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.revenue.net/] Spyware:Cookie/Valueclick Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.valueclick.com/] Spyware:Cookie/myaffiliateprogram Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[www.myaffiliateprogram.com/] Spyware:Cookie/Overture Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.perf.overture.com/] Spyware:Cookie/Server.iad.Liveperson Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[server.iad.liveperson.net/hc/30322322] Spyware:Cookie/Tradedoubler Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.tradedoubler.com/] Spyware:Cookie/RealMedia Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.247realmedia.com/] Spyware:Cookie/Bfast Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.bfast.com/] Spyware:Cookie/Apmebf Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[.apmebf.com/] Spyware:Cookie/Falkag Not disinfected D:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\joknchfj.harrison\cookies.txt[as1.falkag.de/] Virus:Eicar.Mod Renamed D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\eicar.html Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000217.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000218.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000219.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000220.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000221.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000222.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000223.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000224.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000225.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000226.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000227.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000228.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000229.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000230.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000231.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000232.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000233.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000234.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000235.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000236.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000237.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000238.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000239.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000240.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000241.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000242.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000243.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000244.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000245.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000246.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000247.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000248.exe Virus:Trj/Downloader.MDW Disinfected D:\System Volume Information\_restore{6A886AA0-D25B-4FF2-996F-81DBE630D953}\RP1\A0000249.exe Adware:Adware/Block-checker Not disinfected D:\System Volume Information\_restore{8ABA25FD-EECF-4CAB-AD15-4EF006CB3156}\RP13\A0002908.exe Virus:Trj/Alanchum.MV Disinfected D:\System Volume Information\_restore{8ABA25FD-EECF-4CAB-AD15-4EF006CB3156}\RP14\A0002983.exe Virus:Trj/Lager.AH Disinfected D:\System Volume Information\_restore{8ABA25FD-EECF-4CAB-AD15-4EF006CB3156}\RP14\A0002984.exe Virus:Trj/Lager.AH Disinfected D:\System Volume Information\_restore{8ABA25FD-EECF-4CAB-AD15-4EF006CB3156}\RP14\A0002985.exe Adware:Adware/Block-checker Not disinfected D:\System Volume Information\_restore{BE67D841-EFC5-4086-825F-30421FBBECF2}\RP43\A0025135.exe
Post #9 last edited
Run - ATF Cleaner instructions here.

—————-


Then download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Post #11

You still with us???? :unsure:


Sorry little eagle, yes, I'm still here!! It's my Uncle's PC. He lives 150miles away! I will be there this weekend and I will do the Panda Scan and post.

Thanks again
Jonathon

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI