[Closed] trapped in Virtumonde

This computer has been running slow and lots of popup ads. Its a HP Pavilion laptop runningwinXP ver 2002,SP2

Periodically get a panel popping up that says server busy with two buttons - retry (then it goes away) or switch to(then it opens the startup panel). This may be due to the fact there is a vmware player on the machine. I see from task manager that periodically the task called vmware-authid.exe is running. this has been a minor annoyance for a while.

Ran spyware doctor and found hundreds of infected files. Did a cleanup and got rid of many of the problems. However the virtumonde keeps coming back. Tried various software - pestpatrol, Kaspersky, Spysweeper,Lavasoft adware but nothing can kill it.

Kaspersky did get rid of some things not found by Spyware doctor. And it can recognize and block when the bug is trying to insert into other files. However it appearred to cause constant interruptions and slowed down the system. After turning it off it was still creating dozens of avp.exe tasks. Finally uninstalled Kaspersky(it failled a few times on uninstall before I finally got it rmoved .
Spysweeper also slowed the system so I have it deactivated.

Spyware doctor usually appears to cleanup the malware but it ends either (1) says it has to do an immediate restart to clean up some file or (2) says some file will not be cleaned up until the next reboot. In any case virtumonde always returns. Usually there is a file detected name mllml.dll. sometimes there is a different name or and additional similar file.(efcawwt.dll,awstr.dll,ssqru.dll or more recently vtutu.dll) Sometimes its only Virtumonde and sometimes it also reports a trojan downloader (conhook) that has two files named MS Juan and MS Juan ##

Your site refers to the geeks to go malware removal recommendations. Followed their recommendations and ran Vundofix.
it seemed to clean up some files but the log says it cant remove some like mllml.dll. I already tried deleting those with unlocker and they just come back. They are somehow connected to explorer.exe or winlogon.exe. Sometimes it appears that it even connects to the antivirus routines. Vundofix log below.

Then I tried Vundobegone. It also wasnt able to get rid of the virtumonde. Log included below.

I ran a spyware doctor to clean up so the system wouldnt gbe to slow to access the internet. log included below. Then downladed hijack this to my computer. Then rebooted in normal mode and ran hijackthis. The log didnt have much that I recognized as malware except win ini vtutu.dll. I expect that it runs this at startup and rebuilds it self. I thought maybe spyware doctor cleaned uo most of it just before the reboot.

uninstalled one old java version.

Ran spyware doctor again and it said 25 files infected. Exited without taking the option to cleanup. rebooted normal and ran hijackthis again. Log included below.

********************************************************vundofix log********************************************************************
VundoFix V6.7.7

Checking Java version…

Java version is 1.5.0.8
Old versions of java are exploitable and should be removed.

Scan started at 6:25:20 PM 2/2/2008

Listing files found while scanning….

C:\WINDOWS\system32\bgvqhnfc.ini
C:\WINDOWS\system32\cfnhqvgb.dll
C:\WINDOWS\system32\ddccd.exe
C:\WINDOWS\system32\efcawwt.dll
C:\WINDOWS\system32\fkdemvyf.dll
C:\WINDOWS\system32\jkhfc.exe
C:\WINDOWS\system32\mljgh.dll
C:\WINDOWS\system32\mljgh.exe
C:\WINDOWS\system32\pmnll.exe
C:\WINDOWS\system32\ssqpn.exe
C:\WINDOWS\system32\ssttr.exe
C:\WINDOWS\system32\ticwxjks.exe
C:\WINDOWS\system32\wexsuxhs.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\bgvqhnfc.ini
C:\WINDOWS\system32\bgvqhnfc.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\cfnhqvgb.dll
C:\WINDOWS\system32\cfnhqvgb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddccd.exe
C:\WINDOWS\system32\ddccd.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcawwt.dll
C:\WINDOWS\system32\efcawwt.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\fkdemvyf.dll
C:\WINDOWS\system32\fkdemvyf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\jkhfc.exe
C:\WINDOWS\system32\jkhfc.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgh.dll
C:\WINDOWS\system32\mljgh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgh.exe
C:\WINDOWS\system32\mljgh.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnll.exe
C:\WINDOWS\system32\pmnll.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqpn.exe
C:\WINDOWS\system32\ssqpn.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssttr.exe
C:\WINDOWS\system32\ssttr.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\ticwxjks.exe
C:\WINDOWS\system32\ticwxjks.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\wexsuxhs.dll
C:\WINDOWS\system32\wexsuxhs.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal…

Attempting to delete C:\WINDOWS\system32\efcawwt.dll
C:\WINDOWS\system32\efcawwt.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.7.7

Checking Java version…

Java version is 1.5.0.8
Old versions of java are exploitable and should be removed.

Scan started at 7:21:57 PM 2/2/2008

Listing files found while scanning….

C:\WINDOWS\system32\efcawwt.dll
C:\WINDOWS\system32\lmllm.ini
C:\WINDOWS\system32\lmllm.ini2
C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\mllml.exe

Beginning removal…

Attempting to delete C:\WINDOWS\system32\efcawwt.dll
C:\WINDOWS\system32\efcawwt.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\lmllm.ini
C:\WINDOWS\system32\lmllm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\lmllm.ini2
C:\WINDOWS\system32\lmllm.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\mllml.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mllml.exe
C:\WINDOWS\system32\mllml.exe Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal…

Attempting to delete C:\WINDOWS\system32\efcawwt.dll
C:\WINDOWS\system32\efcawwt.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\mllml.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal…
******************************************************** end vundo fix log *****************************************************************
******************************************* vundo be gone log ****************************************************************************

[02/02/2008, 21:01:29] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Hugh Smith\Desktop\VirtumundoBeGone.exe" )
[02/02/2008, 21:01:38] - Detected System Information:
[02/02/2008, 21:01:38] - Windows Version: 5.1.2600, Service Pack 2
[02/02/2008, 21:01:38] - Current Username: Hugh Smith (Admin)
[02/02/2008, 21:01:38] - Windows is in SAFE mode.
[02/02/2008, 21:01:38] - Searching for Browser Helper Objects:
[02/02/2008, 21:01:38] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[02/02/2008, 21:01:38] - BHO 2: {5C118705-A071-C96D-386E-04786228907D} ()
[02/02/2008, 21:01:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/02/2008, 21:01:38] - Checking for HKLM\…\Winlogon\Notify\panvfxm
[02/02/2008, 21:01:38] - Key not found: HKLM\…\Winlogon\Notify\panvfxm, continuing.
[02/02/2008, 21:01:38] - BHO 3: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard)
[02/02/2008, 21:01:38] - BHO 4: {62DDE9FF-9497-423E-AF18-271C800D4E0C} ()
[02/02/2008, 21:01:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/02/2008, 21:01:38] - Checking for HKLM\…\Winlogon\Notify\mllml
[02/02/2008, 21:01:38] - Key not found: HKLM\…\Winlogon\Notify\mllml, continuing.
[02/02/2008, 21:01:38] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/02/2008, 21:01:38] - BHO 6: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor)
[02/02/2008, 21:01:38] - BHO 7: {b690edf4-e3d9-48cb-9377-7735159d6118} ()
[02/02/2008, 21:01:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/02/2008, 21:01:38] - Checking for HKLM\…\Winlogon\Notify\fkdemvyf
[02/02/2008, 21:01:38] - Key not found: HKLM\…\Winlogon\Notify\fkdemvyf, continuing.
[02/02/2008, 21:01:38] - BHO 8: {D7FD6C15-4927-4AAE-BF12-FBDABD287EB1} ()
[02/02/2008, 21:01:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/02/2008, 21:01:38] - Checking for HKLM\…\Winlogon\Notify\efcawwt
[02/02/2008, 21:01:38] - Key not found: HKLM\…\Winlogon\Notify\efcawwt, continuing.
[02/02/2008, 21:01:38] - BHO 9: {DE193261-27C6-4997-BB9C-7B995DACB369} ()
[02/02/2008, 21:01:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/02/2008, 21:01:38] - Checking for HKLM\…\Winlogon\Notify\mljgh
[02/02/2008, 21:01:38] - Key not found: HKLM\…\Winlogon\Notify\mljgh, continuing.
[02/02/2008, 21:01:38] - Finished Searching Browser Helper Objects
[02/02/2008, 21:01:38] - Finishing up…
[02/02/2008, 21:01:38] - Nothing found! Exiting…

************************************************************ end vundo be gone log ****************************************************
******************************** Spyware doctor log ************************************************************************
Spyware Doctor Activity ReportGenerated on 2/4/2008 10:20:53 AM Spyware Doctor Homepage PC Tools Homepage Technical Support


Scans (basic information only):

Scan Results:scan start: 2/4/2008 10:30:30 AM
scan stop: 2/4/2008 11:13:35 AM
scanned items: 131096
found items: 25
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner



Infection Name Location Risk
Trojan.Virtumonde C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@82.98.235[1].txt Elevated
Trojan.Virtumonde C:\Documents and Settings\Hugh Smith\Local Settings\Temporary Internet Files\Content.IE5\JR4GMRH0\443[1].htm Elevated
Trojan.Virtumonde C:\WINDOWS\system32\vtutu.dll Elevated
Trojan.Virtumonde Explorer.exe (C:\WINDOWS\system32\vtutu.dll) Elevated
Trojan.Virtumonde HKCR\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A} Elevated
Trojan.Virtumonde HKCR\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A}## Elevated
Trojan.Virtumonde HKCR\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A}\InprocServer32 Elevated
Trojan.Virtumonde HKCR\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A}\InprocServer32## Elevated
Trojan.Virtumonde HKCR\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A}\InprocServer32##ThreadingModel Elevated
Trojan.Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55C5A51F-468A-44D6-AAED-F499189BE81A} Elevated
Trojan.Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55C5A51F-468A-44D6-AAED-F499189BE81A}## Elevated
Trojan.Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55C5A51F-468A-44D6-AAED-F499189BE81A}\iexplore Elevated
Trojan.Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55C5A51F-468A-44D6-AAED-F499189BE81A}\iexplore## Elevated
Trojan.Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55C5A51F-468A-44D6-AAED-F499189BE81A}\iexplore##Count Elevated
Trojan.Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55C5A51F-468A-44D6-AAED-F499189BE81A}\iexplore##Flags Elevated
Trojan.Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55C5A51F-468A-44D6-AAED-F499189BE81A}\iexplore##Time Elevated
Trojan.Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{55C5A51F-468A-44D6-AAED-F499189BE81A}\iexplore##Type Elevated
Trojan.Virtumonde HKLM\Software\Classes\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A} Elevated
Trojan.Virtumonde HKLM\Software\Classes\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A}## Elevated
Trojan.Virtumonde HKLM\Software\Classes\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A}\InprocServer32 Elevated
Trojan.Virtumonde HKLM\Software\Classes\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A}\InprocServer32## Elevated
Trojan.Virtumonde HKLM\Software\Classes\CLSID\{55C5A51F-468A-44D6-AAED-F499189BE81A}\InprocServer32##ThreadingModel Elevated
Trojan.Virtumonde HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55C5A51F-468A-44D6-AAED-F499189BE81A} Elevated
Trojan.Virtumonde HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55C5A51F-468A-44D6-AAED-F499189BE81A}## Elevated
Trojan.Virtumonde iexplore.exe (C:\WINDOWS\system32\vtutu.dll) Elevated


Other Sections:






Legal Notice

********************************************** end spyware doctor log ********************************************************************

*********************************************** beginning hijackthis log *******************************************************************

Logfile of HijackThis v1.99.1
Scan saved at 11:40:48 AM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Unlocker\UnlockerAssistant .exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe
C:\Program Files\Synaptics\SynTP\SynTPLpr .exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr .exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch .exe
C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Unlocker\UnlockerAssistant .exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched .exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe
F3 - REG:win.ini: load=C:\WINDOWS\system32\vtutu.exe
O1 - Hosts: 66.235.181.40 autoforum.nnov.ru
O1 - Hosts: 66.235.181.40 master-x.com
O1 - Hosts: 66.235.181.40 www.master-x.com
O1 - Hosts: 66.235.181.40 crutop.nu
O1 - Hosts: 66.235.181.40 www.crutop.nu
O1 - Hosts: 66.235.181.40 umaxforum.com
O1 - Hosts: 66.235.181.40 www.blackseo.com
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] "C:\Program Files\HPQ\Default Settings\cpqset.exe"
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant .exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O15 - Trusted Zone: http://www.vectorvest.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} - http://www.vectorvest.com/install/vvonlineusnew/install.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

********************************************************** end hijackthis log ***************************************************************

HELP!!

Thanks

Trevuren,

Below are the logs. aftter combofix rebooted it had a message saying dont run alny programs until the log report was complted(and i didnt) however a pane popped up saying preparing to install , then a mesage saying something about windows security , i didnt respond, then a pane about preparing to install maxtor backup, i gave no response and the last one says you need something from the HP product disk , insert the disk and hit ok. I didnt repond and its still waiting. in the meantime the combofix log report finished so here it follows with the HJT log. How should I respond to the request for the HPProduct disk? Cancel? we have never had those disks?

*********************************************** combofix log *******************************************************************************

ComboFix 08-02.05.3 - Hugh Smith 2008-02-04 20:13:36.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.31 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users.\documents\settings
C:\Documents and Settings\Hugh Smith\My Documents\SSEMBL~1
C:\Documents and Settings\Hugh Smith\My Documents\SSEMBL~1\?ssembly\
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\system32\1.txt
C:\WINDOWS\system32\2.txt
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\efcawwt.dll
C:\WINDOWS\system32\hgjlm.ini
C:\WINDOWS\system32\hgjlm.ini2
C:\WINDOWS\system32\lmllm.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mljgd.exe
C:\WINDOWS\system32\mllml.exe
C:\WINDOWS\system32\npqss.ini
C:\WINDOWS\system32\npqss.ini2
C:\WINDOWS\system32\orqss.ini2
C:\WINDOWS\system32\RCX30.tmp
C:\WINDOWS\system32\RCX49.tmp
C:\WINDOWS\system32\rrutv.ini
C:\WINDOWS\system32\rrutv.ini2
C:\WINDOWS\system32\rstwa.ini2
C:\WINDOWS\system32\rttss.ini2
C:\WINDOWS\system32\skoagkah.ini
C:\WINDOWS\system32\ssqro.exe
C:\WINDOWS\system32\UpMedia
C:\WINDOWS\system32\ututv.ini2
C:\WINDOWS\system32\vturr.dll
C:\WINDOWS\system32\vturr.exe
C:\WINDOWS\system32\vtutu.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-05 to 2008-02-05 )))))))))))))))))))))))))))))))
.

2008-02-03 11:02 . 2008-02-03 11:02 340,992 –a—— C:\WINDOWS\system32\awtsrb.exe
2008-02-02 23:22 . 2008-02-02 23:25 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-02 23:18 . 2008-02-03 19:26 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-02 21:36 . 2008-02-02 21:36 d——– C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-02-02 19:45 . 2008-02-02 19:45 24,576 –a—— C:\WINDOWS\system32\VundoFixSVC.exe
2008-02-02 18:25 . 2008-02-02 19:45 d——– C:\VundoFix Backups
2008-01-30 21:56 . 2008-02-04 19:48 d——– C:\Program Files\Unlocker
2008-01-30 19:52 . 2008-02-04 16:35 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2008-01-30 19:34 . 2008-01-30 19:34 d–hs—- C:\found.001
2008-01-30 16:20 . 2008-01-30 16:20 335,872 –a—— C:\WINDOWS\system32\RCX24A.tmp
2008-01-29 10:53 . 2008-01-29 10:53 d——– C:\Documents and Settings\LocalService\Application Data\Webroot
2008-01-29 10:52 . 2008-01-04 20:34 163,696 –a—— C:\WINDOWS\system32\drivers\ssidrv.sys
2008-01-29 10:52 . 2008-01-04 20:34 23,920 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2008-01-29 10:52 . 2008-01-04 20:34 21,872 –a—— C:\WINDOWS\system32\drivers\sshrmd.sys
2008-01-29 10:52 . 2008-01-04 20:34 20,336 –a—— C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2008-01-29 10:35 . 2008-01-29 10:35 d——– C:\Program Files\Webroot
2008-01-29 10:35 . 2008-01-29 10:35 d——– C:\Documents and Settings\Hugh Smith\Application Data\Webroot
2008-01-29 10:35 . 2008-01-29 10:35 d——– C:\Documents and Settings\All Users\Application Data\Webroot
2008-01-29 10:35 . 2008-01-04 20:56 1,526,640 –a—— C:\WINDOWS\WRSetup.dll
2008-01-29 10:27 . 2008-01-29 10:48 164 –a—— C:\install.dat
2008-01-29 10:24 . 2008-01-29 10:24 15,070,144 –a—— C:\TEMP\ssftrialsnrsetup1_26964077.exe
2008-01-28 23:26 . 2008-01-28 23:26 d——– C:\Program Files\Kaspersky Lab
2008-01-28 23:26 . 2008-02-03 21:05 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-28 23:06 . 2008-01-28 23:06 d——– C:\kav
2008-01-28 21:42 . 2008-01-28 21:42 d——– C:\Documents and Settings\All Users\Application Data\CA
2008-01-28 21:41 . 2008-01-28 23:12 d——– C:\Program Files\Common Files\Scanner
2008-01-28 20:15 . 2007-10-10 15:55 6,065,664 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-28 20:15 . 2007-06-30 19:36 991,232 ——— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-28 20:15 . 2007-10-10 15:55 459,264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-28 20:15 . 2007-10-10 15:55 267,776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-28 20:15 . 2007-10-10 15:55 52,224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-28 20:15 . 2007-10-10 02:59 13,824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-28 20:14 . 2007-06-30 19:31 2,455,488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-28 20:14 . 2007-10-10 15:55 383,488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-28 20:14 . 2007-10-10 15:55 63,488 ——— C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-21 14:26 . 2008-01-21 14:26 d——– C:\Documents and Settings\Administrator.ANABOOK\Application Data\PC Tools
2008-01-21 14:23 . 2005-04-29 05:11 d——– C:\Documents and Settings\Administrator.ANABOOK\Application Data\Symantec
2008-01-21 14:23 . 2005-04-29 05:02 d——– C:\Documents and Settings\Administrator.ANABOOK\Application Data\Apple Computer
2008-01-20 21:18 . 2008-01-20 21:18 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-20 21:18 . 2008-01-20 21:18 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-20 21:10 . 2008-01-20 21:10 d——– C:\Documents and Settings\Hugh Smith\Application Data\Image Zone Express
2008-01-20 21:04 . 2001-08-17 13:56 7,552 –a—— C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2008-01-20 21:04 . 2001-08-17 13:56 7,552 –a—— C:\WINDOWS\system32\dllcache\sonypvu1.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-05 04:24 ——— d—–w C:\Documents and Settings\LocalService\Application Data\VMware
2008-02-05 04:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\VMware
2008-02-05 03:39 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-04 04:33 ——— d—–w C:\Program Files\Spyware Doctor
2008-02-03 21:39 ——— d—–w C:\Program Files\Java
2008-02-03 07:22 ——— d—–w C:\Program Files\Lavasoft
2008-01-31 00:18 ——— d—–w C:\Program Files\QuickTime
2008-01-22 01:55 94,208 —-a-w C:\WINDOWS\DUMP4bce.tmp
2008-01-22 01:53 94,208 —-a-w C:\WINDOWS\DUMP47f5.tmp
2008-01-22 01:51 94,208 —-a-w C:\WINDOWS\DUMP4778.tmp
2008-01-22 01:50 94,208 —-a-w C:\WINDOWS\DUMP48b1.tmp
2008-01-22 01:48 94,208 —-a-w C:\WINDOWS\DUMP4835.tmp
2008-01-22 01:47 94,208 —-a-w C:\WINDOWS\DUMP4816.tmp
2008-01-22 01:45 94,208 —-a-w C:\WINDOWS\DUMP471c.tmp
2008-01-22 01:43 94,208 —-a-w C:\WINDOWS\DUMP4834.tmp
2008-01-22 01:42 94,208 —-a-w C:\WINDOWS\DUMP4815.tmp
2008-01-22 01:40 94,208 —-a-w C:\WINDOWS\DUMP4806.tmp
2008-01-22 01:38 94,208 —-a-w C:\WINDOWS\DUMP4865.tmp
2008-01-22 01:37 94,208 —-a-w C:\WINDOWS\DUMP47e6.tmp
2008-01-22 01:35 94,208 —-a-w C:\WINDOWS\DUMP49bb.tmp
2008-01-22 01:33 94,208 —-a-w C:\WINDOWS\DUMP47b7.tmp
2008-01-22 01:32 94,208 —-a-w C:\WINDOWS\DUMP4864.tmp
2008-01-22 01:30 94,208 —-a-w C:\WINDOWS\DUMP472a.tmp
2008-01-22 01:29 94,208 —-a-w C:\WINDOWS\DUMP471b.tmp
2008-01-22 01:27 94,208 —-a-w C:\WINDOWS\DUMP48d0.tmp
2008-01-22 01:26 94,208 —-a-w C:\WINDOWS\DUMP470b.tmp
2008-01-22 01:24 94,208 —-a-w C:\WINDOWS\DUMP495d.tmp
2008-01-22 01:22 94,208 —-a-w C:\WINDOWS\DUMP474a.tmp
2008-01-21 23:41 94,208 —-a-w C:\WINDOWS\DUMP4a18.tmp
2008-01-21 22:22 94,208 —-a-w C:\WINDOWS\DUMP445c.tmp
2008-01-21 22:19 94,208 —-a-w C:\WINDOWS\DUMP4c89.tmp
2008-01-21 22:17 94,208 —-a-w C:\WINDOWS\DUMP2eb1.tmp
2008-01-21 22:16 94,208 —-a-w C:\WINDOWS\DUMP320f.tmp
2008-01-21 22:15 94,208 —-a-w C:\WINDOWS\DUMP30d7.tmp
2008-01-21 22:13 94,208 —-a-w C:\WINDOWS\DUMP2e48.tmp
2008-01-21 22:11 94,208 —-a-w C:\WINDOWS\DUMP4805.tmp
2008-01-21 22:10 94,208 —-a-w C:\WINDOWS\DUMP4ac4.tmp
2008-01-21 22:08 94,208 —-a-w C:\WINDOWS\DUMP3c2e.tmp
2008-01-21 22:07 94,208 —-a-w C:\WINDOWS\DUMP50cf.tmp
2008-01-21 22:04 94,208 —-a-w C:\WINDOWS\DUMP3c7d.tmp
2008-01-21 22:02 94,208 —-a-w C:\WINDOWS\DUMP48a1.tmp
2008-01-21 22:00 94,208 —-a-w C:\WINDOWS\DUMP30d6.tmp
2008-01-21 21:59 94,208 —-a-w C:\WINDOWS\DUMP3c8c.tmp
2008-01-21 21:53 94,208 —-a-w C:\WINDOWS\DUMP42f4.tmp
2008-01-21 21:51 94,208 —-a-w C:\WINDOWS\DUMP3901.tmp
2008-01-21 21:50 94,208 —-a-w C:\WINDOWS\DUMP396f.tmp
2008-01-21 21:48 94,208 —-a-w C:\WINDOWS\DUMP3912.tmp
2008-01-21 21:47 94,208 —-a-w C:\WINDOWS\DUMP395f.tmp
2008-01-21 21:46 94,208 —-a-w C:\WINDOWS\DUMP38b3.tmp
2008-01-21 21:44 94,208 —-a-w C:\WINDOWS\DUMP397e.tmp
2008-01-21 21:43 94,208 —-a-w C:\WINDOWS\DUMP3911.tmp
2008-01-21 21:42 94,208 —-a-w C:\WINDOWS\DUMP394f.tmp
2008-01-21 21:40 94,208 —-a-w C:\WINDOWS\DUMP4824.tmp
2008-01-21 21:38 94,208 —-a-w C:\WINDOWS\DUMP4863.tmp
2008-01-21 21:36 94,208 —-a-w C:\WINDOWS\DUMP48ff.tmp
2008-01-21 21:34 94,208 —-a-w C:\WINDOWS\DUMP4798.tmp
2008-01-21 21:32 94,208 —-a-w C:\WINDOWS\DUMP4d93.tmp
2008-01-21 21:31 94,208 —-a-w C:\WINDOWS\DUMP2ec2.tmp
2008-01-21 21:30 94,208 —-a-w C:\WINDOWS\DUMP2cdc.tmp
2008-01-21 21:28 94,208 —-a-w C:\WINDOWS\DUMP300b.tmp
2008-01-21 21:26 94,208 —-a-w C:\WINDOWS\DUMP3de3.tmp
2008-01-21 21:25 94,208 —-a-w C:\WINDOWS\DUMP3a3a.tmp
2008-01-21 21:23 94,208 —-a-w C:\WINDOWS\DUMP3f1c.tmp
2008-01-21 16:21 94,208 —-a-w C:\WINDOWS\DUMP50b0.tmp
2008-01-21 16:19 94,208 —-a-w C:\WINDOWS\DUMP2fb0.tmp
2008-01-21 16:17 94,208 —-a-w C:\WINDOWS\DUMP31be.tmp
2008-01-21 16:15 94,208 —-a-w C:\WINDOWS\DUMP2d3c.tmp
2008-01-21 16:14 94,208 —-a-w C:\WINDOWS\DUMP2e95.tmp
2008-01-21 16:12 94,208 —-a-w C:\WINDOWS\DUMP3155.tmp
2008-01-21 16:11 94,208 —-a-w C:\WINDOWS\DUMP2e18.tmp
2008-01-21 16:09 94,208 —-a-w C:\WINDOWS\DUMP32f8.tmp
2008-01-21 16:08 94,208 —-a-w C:\WINDOWS\DUMP2ea3.tmp
2008-01-21 16:06 94,208 —-a-w C:\WINDOWS\DUMP2fcb.tmp
2008-01-21 16:04 94,208 —-a-w C:\WINDOWS\DUMP2ea2.tmp
2008-01-21 16:03 94,208 —-a-w C:\WINDOWS\DUMP302c.tmp
2008-01-21 16:01 94,208 —-a-w C:\WINDOWS\DUMP3122.tmp
2008-01-21 16:00 94,208 —-a-w C:\WINDOWS\DUMP30e5.tmp
2008-01-21 15:58 94,208 —-a-w C:\WINDOWS\DUMP2f42.tmp
2008-01-21 15:57 94,208 —-a-w C:\WINDOWS\DUMP2e94.tmp
2008-01-21 15:55 94,208 —-a-w C:\WINDOWS\DUMP2ef2.tmp
2008-01-21 15:54 94,208 —-a-w C:\WINDOWS\DUMP2dd6.tmp
2008-01-21 15:52 94,208 —-a-w C:\WINDOWS\DUMP2e8a.tmp
2008-01-21 15:51 94,208 —-a-w C:\WINDOWS\DUMP3154.tmp
2008-01-21 15:49 94,208 —-a-w C:\WINDOWS\DUMP2e56.tmp
2008-01-21 15:48 94,208 —-a-w C:\WINDOWS\DUMP32eb.tmp
2008-01-21 15:46 94,208 —-a-w C:\WINDOWS\DUMP2d6a.tmp
2008-01-21 15:44 94,208 —-a-w C:\WINDOWS\DUMP2faf.tmp
2008-01-21 15:43 94,208 —-a-w C:\WINDOWS\DUMP2ec1.tmp
2008-01-21 15:42 94,208 —-a-w C:\WINDOWS\DUMP2fae.tmp
2008-01-21 15:40 94,208 —-a-w C:\WINDOWS\DUMP2dc6.tmp
2008-01-21 15:39 94,208 —-a-w C:\WINDOWS\DUMP2e47.tmp
2008-01-21 15:37 94,208 —-a-w C:\WINDOWS\DUMP323c.tmp
2008-01-21 15:36 94,208 —-a-w C:\WINDOWS\DUMP30e4.tmp
2008-01-21 15:34 94,208 —-a-w C:\WINDOWS\DUMP2f8e.tmp
2008-01-21 15:33 94,208 —-a-w C:\WINDOWS\DUMP2e89.tmp
2008-01-21 15:31 94,208 —-a-w C:\WINDOWS\DUMP2ed5.tmp
2008-01-21 15:30 94,208 —-a-w C:\WINDOWS\DUMP3163.tmp
2008-01-21 15:28 94,208 —-a-w C:\WINDOWS\DUMP2daa.tmp
2008-01-21 15:27 94,208 —-a-w C:\WINDOWS\DUMP3529.tmp
2008-01-21 15:25 94,208 —-a-w C:\WINDOWS\DUMP2e17.tmp
.

—-a-w		   253,952 2008-01-30 23:15:16  C:\hp\drivers\hplsbwatcher\lsburnwatcher .exe
—-a-w		   339,968 2008-02-05 03:48:21  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe
—-a-w		   180,269 2008-01-31 00:43:56  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
—-a-w			49,152 2008-02-05 03:48:30  C:\Program Files\Hp\HP Software Update\HPWuSchd2 .exe
—-a-w		   233,534 2008-01-30 23:15:15  C:\Program Files\HPQ\Default Settings\cpqset .exe
—-a-w		   794,624 2008-01-27 07:34:14  C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant .exe
—-a-w		   649,728 2008-01-30 23:15:14  C:\Program Files\HPQ\Quick Launch Buttons\EabServr .exe
—-a-w			83,608 2008-02-05 03:48:32  C:\Program Files\Java\jre1.6.0_01\bin\jusched .exe
—-a-w		   227,856 2008-02-04 05:00:42  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe
—-a-w		   712,704 2008-02-05 03:48:28  C:\Program Files\Maxtor\OneTouch\Utils\Onetouch .exe
—-a-w			81,920 2008-02-05 03:48:25  C:\Program Files\Maxtor\OneTouch Status\maxmenumgr .exe
—-a-w		 1,694,208 2008-02-05 03:48:38  C:\Program Files\Messenger\msmsgs .exe
—-a-w		   444,416 2008-01-30 23:14:19  C:\Program Files\QuickTime\qttask				   .exe
—-a-w		   444,416 2008-01-30 21:38:06  C:\Program Files\QuickTime\qttask				  .exe
—-a-w		   444,416 2008-01-30 05:17:42  C:\Program Files\QuickTime\qttask				 .exe
—-a-w		   444,416 2008-01-30 03:42:06  C:\Program Files\QuickTime\qttask				.exe
—-a-w		   444,416 2008-01-29 19:00:55  C:\Program Files\QuickTime\qttask			   .exe
—-a-w		   444,416 2008-01-29 16:43:55  C:\Program Files\QuickTime\qttask			  .exe
—-a-w		   450,048 2008-01-29 11:18:39  C:\Program Files\QuickTime\qttask			 .exe
—-a-w		   444,416 2008-01-29 08:25:38  C:\Program Files\QuickTime\qttask			.exe
—-a-w		   444,416 2008-01-29 07:36:35  C:\Program Files\QuickTime\qttask		   .exe
—-a-w		   444,416 2008-01-29 07:16:55  C:\Program Files\QuickTime\qttask		  .exe
—-a-w		   444,416 2008-01-29 04:40:01  C:\Program Files\QuickTime\qttask		 .exe
—-a-w		   436,736 2008-01-27 23:55:11  C:\Program Files\QuickTime\qttask		.exe
—-a-w		   436,736 2008-01-27 22:09:47  C:\Program Files\QuickTime\qttask	   .exe
—-a-w		   445,952 2008-01-27 04:40:18  C:\Program Files\QuickTime\qttask	  .exe
—-a-w		   445,952 2008-01-25 16:23:05  C:\Program Files\QuickTime\qttask	 .exe
—-a-w		   445,952 2008-01-24 19:47:15  C:\Program Files\QuickTime\qttask	.exe
—-a-w		   445,952 2008-01-24 19:35:27  C:\Program Files\QuickTime\qttask   .exe
—-a-w		   436,736 2008-01-23 16:55:53  C:\Program Files\QuickTime\qttask  .exe
—-a-w		   436,736 2008-01-23 16:24:29  C:\Program Files\QuickTime\qttask .exe
—-a-w		   692,316 2008-01-31 00:44:29  C:\Program Files\Synaptics\SynTP\SynTPEnh  .exe
—-a-w		   102,492 2008-02-05 03:48:21  C:\Program Files\Synaptics\SynTP\SynTPLpr .exe
—-a-w			15,872 2008-02-05 03:48:31  C:\Program Files\Unlocker\UnlockerAssistant				  .exe
—-a-w		   358,400 2008-02-05 03:45:41  C:\Program Files\Unlocker\UnlockerAssistant				 .exe
—-a-w		   358,400 2008-02-05 00:35:06  C:\Program Files\Unlocker\UnlockerAssistant				.exe
—-a-w		   358,400 2008-02-04 19:37:00  C:\Program Files\Unlocker\UnlockerAssistant			   .exe
—-a-w		   358,400 2008-02-04 17:40:32  C:\Program Files\Unlocker\UnlockerAssistant			  .exe
—-a-w		   358,400 2008-02-04 15:25:40  C:\Program Files\Unlocker\UnlockerAssistant			 .exe
—-a-w		   353,280 2008-02-04 06:40:25  C:\Program Files\Unlocker\UnlockerAssistant			.exe
—-a-w		   358,400 2008-02-04 05:00:55  C:\Program Files\Unlocker\UnlockerAssistant		   .exe
—-a-w		   358,400 2008-02-03 20:46:06  C:\Program Files\Unlocker\UnlockerAssistant		  .exe
—-a-w		   353,280 2008-02-03 05:46:11  C:\Program Files\Unlocker\UnlockerAssistant		 .exe
—-a-w		   353,280 2008-02-03 05:20:41  C:\Program Files\Unlocker\UnlockerAssistant		.exe
—-a-w		   353,280 2008-02-03 05:08:47  C:\Program Files\Unlocker\UnlockerAssistant	   .exe
—-a-w		   353,280 2008-02-03 03:48:24  C:\Program Files\Unlocker\UnlockerAssistant	  .exe
—-a-w		   353,280 2008-02-01 17:14:18  C:\Program Files\Unlocker\UnlockerAssistant	 .exe
—-a-w		   353,280 2008-02-01 16:58:42  C:\Program Files\Unlocker\UnlockerAssistant	.exe
—-a-w		   353,280 2008-02-01 05:59:08  C:\Program Files\Unlocker\UnlockerAssistant   .exe
—-a-w		   353,280 2008-01-31 17:17:00  C:\Program Files\Unlocker\UnlockerAssistant  .exe
—-a-w		   353,280 2008-01-31 16:29:52  C:\Program Files\Unlocker\UnlockerAssistant .exe
—-a-w		 5,367,664 2008-02-01 17:15:46  C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI .exe
—-a-w		 5,025,280 2008-01-27 07:45:21  C:\Program Files\Yahoo!\Messenger\YahooMessenger	  .exe
—-a-w		 5,034,496 2008-01-27 07:34:54  C:\Program Files\Yahoo!\Messenger\YahooMessenger	 .exe
—-a-w		 5,034,496 2008-01-25 16:22:27  C:\Program Files\Yahoo!\Messenger\YahooMessenger	.exe
—-a-w		 5,034,496 2008-01-24 19:46:27  C:\Program Files\Yahoo!\Messenger\YahooMessenger   .exe
—-a-w		 5,025,280 2008-01-23 16:55:09  C:\Program Files\Yahoo!\Messenger\YahooMessenger  .exe
—-a-w		 4,670,704 2008-01-27 07:45:51  C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
—-a-w			15,360 2008-02-05 00:35:39  C:\WINDOWS\system32\ctfmon .exe

– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57C3C205-FB6D-46E0-9633-D1BEAE520B6A}]
C:\WINDOWS\system32\ssqro.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C118705-A071-C96D-386E-04786228907D}]
C:\WINDOWS\system32\panvfxm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{902031E3-D28A-4DAB-A02E-53202E8B01FF}]
C:\WINDOWS\system32\mllml.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A2CDDBDF-56F9-4928-B6A5-01D047B691C8}]
C:\WINDOWS\system32\vtutu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b690edf4-e3d9-48cb-9377-7735159d6118}]
C:\WINDOWS\system32\fkdemvyf.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DE193261-27C6-4997-BB9C-7B995DACB369}]
C:\WINDOWS\system32\mljgh.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [ ]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [ ]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [ ]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [ ]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [ ]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [ ]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [ ]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [ ]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2005-10-17 16:24 81920]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [ ]
"eTrustPPAP"="C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe" [ ]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant .exe" [2008-02-04 19:48 15872]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [ ]
"@"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2006-02-05 09:04 2115728]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe [2005-12-15 11:40:44 282624]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-20 10:15:54 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2004-10-13 15:04 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-01-21 21:15 436736 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 07:18]
S3 dump_wmimmc;dump_wmimmc;C:\Nexon\KartRider\GameGuard\dump_wmimmc.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-02-04 10:00:02 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job"
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex
- C:\
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 20:25:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Unlocker\UnlockerHook.dll
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
.
**************************************************************************
.
Completion time: 2008-02-04 20:31:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-05 04:31:26
.
2008-02-01 16:10:21 — E O F —

************************************************** end of combofix log ********************************************************************

************************************************ new HIJackThis log *********************************************************************

Logfile of HijackThis v1.99.1
Scan saved at 20:41, on 2008-02-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Unlocker\UnlockerAssistant .exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Hijackthis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {57C3C205-FB6D-46E0-9633-D1BEAE520B6A} - C:\WINDOWS\system32\ssqro.dll (file missing)
O2 - BHO: (no name) - {5C118705-A071-C96D-386E-04786228907D} - C:\WINDOWS\system32\panvfxm.dll (file missing)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {902031E3-D28A-4DAB-A02E-53202E8B01FF} - C:\WINDOWS\system32\mllml.dll (file missing)
O2 - BHO: (no name) - {A2CDDBDF-56F9-4928-B6A5-01D047B691C8} - C:\WINDOWS\system32\vtutu.dll (file missing)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: {8116d951-5377-7739-bc84-9d3e4fde096b} - {b690edf4-e3d9-48cb-9377-7735159d6118} - C:\WINDOWS\system32\fkdemvyf.dll (file missing)
O2 - BHO: (no name) - {DE193261-27C6-4997-BB9C-7B995DACB369} - C:\WINDOWS\system32\mljgh.dll (file missing)
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] "C:\Program Files\HPQ\Default Settings\cpqset.exe"
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant .exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O15 - Trusted Zone: http://www.vectorvest.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} - http://www.vectorvest.com/install/vvonlineusnew/install.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

************************************************ end of new HJT log ***********************************************************************

Thanks so much for your help!!!!

Trevuren,

I ran the combofix script. When it rebooted the machine windows started to come up but stopped at the part where usually there is an option to log on to one of two userids. It stayed on the HP blue and white screen with no users for a very long time. Finally I rebooted normally. It seemed to be working somewhat better. I found the combofix log and included it below.

However the icons are slow to light up on startup and I still get the periodic message panel popping up saying : server busy below it says " this action can not be completed because the other program is busy. choose switch to activate the busy program and correct the problem." below there are two buttons - one for retry and one saying switch to.

I ran spyware doctor again. it found only 12 files this time - some cookies and 4 files related to virtumonde . said to reboot to complete cleanup.

ran lavasoft adaware - found 13 cookies and cleaned them up.

rebooted and second try with spyware doctor and it looked clean

ran spyware sweeper

reported 3 adware searchtool,commaid, mirar-webband and some cookies maybe files in quarantine and already marked bad.


ran hijackthis and included log below

forgot to insure all monitors off - can redo if required

ran kapersky online and included log below. Again many thanks for you help.


************************************combofix script log ***************************************************************************

ComboFix 08-02.05.3 - Hugh Smith 2008-02-04 21:42:43.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hugh Smith\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\found.001
C:\install.dat
C:\WINDOWS\DUMP2cdc.tmp
C:\WINDOWS\DUMP2d3c.tmp
C:\WINDOWS\DUMP2d6a.tmp
C:\WINDOWS\DUMP2daa.tmp
C:\WINDOWS\DUMP2dc6.tmp
C:\WINDOWS\DUMP2dd6.tmp
C:\WINDOWS\DUMP2e17.tmp
C:\WINDOWS\DUMP2e18.tmp
C:\WINDOWS\DUMP2e47.tmp
C:\WINDOWS\DUMP2e48.tmp
C:\WINDOWS\DUMP2e56.tmp
C:\WINDOWS\DUMP2e89.tmp
C:\WINDOWS\DUMP2e8a.tmp
C:\WINDOWS\DUMP2e94.tmp
C:\WINDOWS\DUMP2e95.tmp
C:\WINDOWS\DUMP2ea2.tmp
C:\WINDOWS\DUMP2ea3.tmp
C:\WINDOWS\DUMP2eb1.tmp
C:\WINDOWS\DUMP2ec1.tmp
C:\WINDOWS\DUMP2ec2.tmp
C:\WINDOWS\DUMP2ed5.tmp
C:\WINDOWS\DUMP2ef2.tmp
C:\WINDOWS\DUMP2f42.tmp
C:\WINDOWS\DUMP2f8e.tmp
C:\WINDOWS\DUMP2fae.tmp
C:\WINDOWS\DUMP2faf.tmp
C:\WINDOWS\DUMP2fb0.tmp
C:\WINDOWS\DUMP2fcb.tmp
C:\WINDOWS\DUMP300b.tmp
C:\WINDOWS\DUMP302c.tmp
C:\WINDOWS\DUMP30d6.tmp
C:\WINDOWS\DUMP30d7.tmp
C:\WINDOWS\DUMP30e4.tmp
C:\WINDOWS\DUMP30e5.tmp
C:\WINDOWS\DUMP3122.tmp
C:\WINDOWS\DUMP3154.tmp
C:\WINDOWS\DUMP3155.tmp
C:\WINDOWS\DUMP3163.tmp
C:\WINDOWS\DUMP31be.tmp
C:\WINDOWS\DUMP320f.tmp
C:\WINDOWS\DUMP323c.tmp
C:\WINDOWS\DUMP32eb.tmp
C:\WINDOWS\DUMP32f8.tmp
C:\WINDOWS\DUMP3529.tmp
C:\WINDOWS\DUMP38b3.tmp
C:\WINDOWS\DUMP3901.tmp
C:\WINDOWS\DUMP3911.tmp
C:\WINDOWS\DUMP3912.tmp
C:\WINDOWS\DUMP394f.tmp
C:\WINDOWS\DUMP395f.tmp
C:\WINDOWS\DUMP396f.tmp
C:\WINDOWS\DUMP397e.tmp
C:\WINDOWS\DUMP3a3a.tmp
C:\WINDOWS\DUMP3c2e.tmp
C:\WINDOWS\DUMP3c7d.tmp
C:\WINDOWS\DUMP3c8c.tmp
C:\WINDOWS\DUMP3de3.tmp
C:\WINDOWS\DUMP3f1c.tmp
C:\WINDOWS\DUMP42f4.tmp
C:\WINDOWS\DUMP445c.tmp
C:\WINDOWS\DUMP470b.tmp
C:\WINDOWS\DUMP471b.tmp
C:\WINDOWS\DUMP471c.tmp
C:\WINDOWS\DUMP472a.tmp
C:\WINDOWS\DUMP474a.tmp
C:\WINDOWS\DUMP4778.tmp
C:\WINDOWS\DUMP4798.tmp
C:\WINDOWS\DUMP47b7.tmp
C:\WINDOWS\DUMP47e6.tmp
C:\WINDOWS\DUMP47f5.tmp
C:\WINDOWS\DUMP4805.tmp
C:\WINDOWS\DUMP4806.tmp
C:\WINDOWS\DUMP4815.tmp
C:\WINDOWS\DUMP4816.tmp
C:\WINDOWS\DUMP4824.tmp
C:\WINDOWS\DUMP4834.tmp
C:\WINDOWS\DUMP4835.tmp
C:\WINDOWS\DUMP4863.tmp
C:\WINDOWS\DUMP4864.tmp
C:\WINDOWS\DUMP4865.tmp
C:\WINDOWS\DUMP48a1.tmp
C:\WINDOWS\DUMP48b1.tmp
C:\WINDOWS\DUMP48d0.tmp
C:\WINDOWS\DUMP48ff.tmp
C:\WINDOWS\DUMP495d.tmp
C:\WINDOWS\DUMP49bb.tmp
C:\WINDOWS\DUMP4a18.tmp
C:\WINDOWS\DUMP4ac4.tmp
C:\WINDOWS\DUMP4bce.tmp
C:\WINDOWS\DUMP4c89.tmp
C:\WINDOWS\DUMP4d93.tmp
C:\WINDOWS\DUMP50b0.tmp
C:\WINDOWS\DUMP50cf.tmp
C:\WINDOWS\system32\awtsrb.exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\RCX24A.tmp
C:\WINDOWS\system32\VundoFixSVC.exe
.
/wow section - STAGE 8
/wow section not completed

********************************************************* end of combo fix script log *****************************************************


********************************************************* HJT log ************************************************************************

Logfile of HijackThis v1.99.1
Scan saved at 08:52, on 2008-02-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hijackthis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {57C3C205-FB6D-46E0-9633-D1BEAE520B6A} - C:\WINDOWS\system32\ssqro.dll (file missing)
O2 - BHO: (no name) - {5C118705-A071-C96D-386E-04786228907D} - C:\WINDOWS\system32\panvfxm.dll (file missing)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {902031E3-D28A-4DAB-A02E-53202E8B01FF} - C:\WINDOWS\system32\mllml.dll (file missing)
O2 - BHO: (no name) - {A2CDDBDF-56F9-4928-B6A5-01D047B691C8} - C:\WINDOWS\system32\vtutu.dll (file missing)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: {8116d951-5377-7739-bc84-9d3e4fde096b} - {b690edf4-e3d9-48cb-9377-7735159d6118} - C:\WINDOWS\system32\fkdemvyf.dll (file missing)
O2 - BHO: (no name) - {DE193261-27C6-4997-BB9C-7B995DACB369} - C:\WINDOWS\system32\mljgh.dll (file missing)
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant .exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O15 - Trusted Zone: http://www.vectorvest.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} - http://www.vectorvest.com/install/vvonlineusnew/install.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

************************************************************* end of HJT log *********************************************************


************************************************************** kaspersky log **********************************************************
——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
2008-02-06 15:12
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 6/02/2008
Kaspersky Anti-Virus database records: 552526
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
Z:\

Scan Statistics:
Total number of scanned objects: 58495
Number of viruses found: 10
Number of infected objects: 417
Number of suspicious objects: 0
Duration of the scan process: 01:29:10

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Local Settings\Temp\hsperfdata_Administrator\1468 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\0102\0310\values Object is locked skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\6.0\56\3c28cc78-5a965234/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\6.0\56\3c28cc78-5a965234 ZIP: infected - 1 skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-27406485-4dcdf5dd.zip/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-27406485-4dcdf5dd.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-526002f4-10087a71.zip/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-526002f4-10087a71.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-1f442ed4-173157ba.zip/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-1f442ed4-173157ba.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-74249065-21385085.zip/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped
C:\Documents and Settings\Hugh Smith\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-74249065-21385085.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Hugh Smith\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Hugh Smith\Desktop\aaqq.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped
C:\Documents and Settings\Hugh Smith\Desktop\ooqq.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\Hugh Smith\Desktop\vvqq.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Agent.abh skipped
C:\Documents and Settings\Hugh Smith\Desktop\vvqq.exe/stream Infected: not-a-virus:AdWare.Win32.Agent.abh skipped
C:\Documents and Settings\Hugh Smith\Desktop\vvqq.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Hugh Smith\Incomplete\Preview-T-3098403-02 Track 2.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\Hugh Smith\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Hugh Smith\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Hugh Smith\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Hugh Smith\Local Settings\History\History.IE5\MSHist012008020620080207\index.dat Object is locked skipped
C:\Documents and Settings\Hugh Smith\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\Hugh Smith\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Hugh Smith\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Hugh Smith\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Hugh Smith\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Hugh Smith\Shared\02 Track 2.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\Hugh Smith\Shared\06 Track 6.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\QuickTime\qttask.exe Infected: Virus.Win32.Trats.d skipped
C:\Program Files\Unlocker\UnlockerAssistant.exe Infected: Virus.Win32.Trats.d skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped
C:\QooBox\Quarantine\C\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Hp\HP Software Update\HPWuSchd2.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Java\jre1.6.0_01\bin\jusched.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Maxtor\OneTouch\Utils\Onetouch.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Messenger\msmsgs.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Synaptics\SynTP\SynTPEnh .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Synaptics\SynTP\SynTPLpr.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\awtsrb.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ctfmon.exe.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\efcawwt.dll.vir Infected: Trojan-Downloader.Win32.Small.htr skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mljgd.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mllml.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX24A.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX30.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX49.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqro.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vturr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vturr.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtutu.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\RECYCLER\S-1-5-21-1482410674-3305377198-2803331660-1008\Dc4.wm Infected: Trojan-Downloader.WMA.Wimad.m skipped
C:\RECYCLER\S-1-5-21-1482410674-3305377198-2803331660-1008\Dc5.wma Infected: Trojan-Downloader.WMA.Wimad.k skipped
C:\RECYCLER\S-1-5-21-1482410674-3305377198-2803331660-1008\Dc6.wma Infected: Trojan-Downloader.WMA.Wimad.k skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822951.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822952.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822953.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822954.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822955.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822956.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822957.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822958.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822959.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822960.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822961.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0822967.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823947.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823950.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823951.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823952.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823953.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823954.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823955.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823956.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823957.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823958.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823959.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823960.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823963.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\Fifoed\A0823967.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824947.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824950.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824951.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824952.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824953.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824954.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824955.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824956.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824957.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824958.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824959.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824960.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824962.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0824966.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825945.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825947.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825950.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825951.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825952.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825953.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825954.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825955.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825956.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825957.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825958.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825959.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825960.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825961.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825962.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825963.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0825968.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826947.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826950.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826951.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826952.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826953.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826954.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826955.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826956.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826957.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0826965.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0827947.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0827950.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0827951.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0827952.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0827953.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0827954.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0827955.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0827956.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0829973.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0829980.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0829982.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0829983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0829984.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0829985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0829986.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0829987.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830976.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830978.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830980.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830981.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830982.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830984.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830986.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0830999.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0831001.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834973.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834978.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834981.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834982.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834984.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834986.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834987.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834988.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0834989.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0835978.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0835981.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0835982.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0835983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0835984.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0835985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0835986.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0835988.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0836977.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0836980.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0836981.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0836982.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0836983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0836984.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0836985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP447\A0836996.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0837983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0837986.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0837987.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0837988.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0837989.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0837990.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0837991.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0837994.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0838980.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0838982.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0838983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0838984.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0838985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0838986.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0838987.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP449\A0838989.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841018.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841020.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841021.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841022.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841023.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841024.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841025.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841026.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841027.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841030.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841039.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841042.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841043.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841044.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841045.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841046.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841047.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841048.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841060.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841070.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841073.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841074.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841075.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841076.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841077.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841078.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841081.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841086.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841088.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841089.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841090.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841091.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841092.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841093.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841094.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841095.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841096.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841097.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841119.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841122.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841123.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841124.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841125.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841126.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841127.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0841129.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842117.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842119.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842120.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842121.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842122.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842123.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842124.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842125.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842127.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842128.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842132.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842134.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842136.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842137.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842138.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842139.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842140.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842141.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842142.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842143.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP450\A0842144.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0842172.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0842180.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0842182.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0842183.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0842184.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0842185.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0842186.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0842187.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843177.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843180.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843181.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843182.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843183.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843184.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843185.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843186.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP451\A0843187.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843358.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843360.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843361.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843362.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843363.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843364.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843366.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843367.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843386.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843389.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843390.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843392.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843393.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843394.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843395.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843396.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843397.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP452\A0843410.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843416.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843418.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843419.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843420.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843421.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843422.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843424.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843425.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0843490.rbf Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844383.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844481.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844484.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844485.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844486.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844487.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844488.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844489.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844490.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844491.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844505.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844510.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844512.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844513.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844514.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844515.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844516.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844518.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844521.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844527.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844529.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844530.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844531.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844532.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844533.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844534.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844535.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844552.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844555.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844556.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844557.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844558.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844559.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844561.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0844562.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845552.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845555.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845556.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845557.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845558.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845559.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845560.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845561.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845562.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845564.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845585.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845590.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845592.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845593.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845594.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845595.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845596.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845597.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP453\A0845598.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845615.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845616.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845617.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845618.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845619.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845620.dll Infected: Trojan-Downloader.Win32.Small.htr skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845621.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845625.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845626.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845627.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845628.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845629.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845630.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845631.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP454\A0845632.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848642.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848643.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848644.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848645.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848646.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848647.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848648.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848649.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848650.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848651.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848652.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848653.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848654.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848655.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848656.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848657.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848658.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848659.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848660.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848661.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848663.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848664.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848665.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848666.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848667.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848668.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848669.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848670.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848671.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848672.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848673.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848674.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848675.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848676.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848677.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848678.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848679.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848680.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848681.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848682.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848683.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0848687.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP455\A0849647.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP456\change.log Object is locked skipped
C:\VundoFix Backups\cfnhqvgb.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ddccd.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\efcawwt.dll.bad Infected: Trojan-Downloader.Win32.Small.htr skipped
C:\VundoFix Backups\fkdemvyf.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\jkhfc.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\mljgh.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\mljgh.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\mllml.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\mllml.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\pmnll.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\ssqpn.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\ssttr.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\ticwxjks.exe.bad Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\VundoFix Backups\wexsuxhs.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

************************************************************ end of kaspersky log ******************************************************

Trevuren,

I uninstalled Unlocker and spy sweeper. For Spyware doctor I turned onguard protection to off. The combofix script appears to have run to completion and rebooted the machine normally.

When it came back up it said that the log report was being prepeARED AND DONT run any programs. Some Hp routines ran and pop open some windows. In the bottom right corner there was a balloon with a message that says you have files waiting to be copied to CD. I didnt click the balloon this time but in the past i saw these are jpg and mpg files its referring to.

The system busy panal popped up once but went away. a windows security alert popped up saying it was blocking the HP network rediscovery service.

after a long time combofix said almost done , then said its finished. I am including the combofix log here and the hjt log. Should I go forward with the Kaspersky online scan or should I rerun the combo fix again? Thanks



***************************************************** combofix log *********************************************************************

ComboFix 08-02.05.3 - Hugh Smith 2008-02-06 19:13:16.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.27 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hugh Smith\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\found.001
C:\install.dat
C:\WINDOWS\DUMP2cdc.tmp
C:\WINDOWS\DUMP2d3c.tmp
C:\WINDOWS\DUMP2d6a.tmp
C:\WINDOWS\DUMP2daa.tmp
C:\WINDOWS\DUMP2dc6.tmp
C:\WINDOWS\DUMP2dd6.tmp
C:\WINDOWS\DUMP2e17.tmp
C:\WINDOWS\DUMP2e18.tmp
C:\WINDOWS\DUMP2e47.tmp
C:\WINDOWS\DUMP2e48.tmp
C:\WINDOWS\DUMP2e56.tmp
C:\WINDOWS\DUMP2e89.tmp
C:\WINDOWS\DUMP2e8a.tmp
C:\WINDOWS\DUMP2e94.tmp
C:\WINDOWS\DUMP2e95.tmp
C:\WINDOWS\DUMP2ea2.tmp
C:\WINDOWS\DUMP2ea3.tmp
C:\WINDOWS\DUMP2eb1.tmp
C:\WINDOWS\DUMP2ec1.tmp
C:\WINDOWS\DUMP2ec2.tmp
C:\WINDOWS\DUMP2ed5.tmp
C:\WINDOWS\DUMP2ef2.tmp
C:\WINDOWS\DUMP2f42.tmp
C:\WINDOWS\DUMP2f8e.tmp
C:\WINDOWS\DUMP2fae.tmp
C:\WINDOWS\DUMP2faf.tmp
C:\WINDOWS\DUMP2fb0.tmp
C:\WINDOWS\DUMP2fcb.tmp
C:\WINDOWS\DUMP300b.tmp
C:\WINDOWS\DUMP302c.tmp
C:\WINDOWS\DUMP30d6.tmp
C:\WINDOWS\DUMP30d7.tmp
C:\WINDOWS\DUMP30e4.tmp
C:\WINDOWS\DUMP30e5.tmp
C:\WINDOWS\DUMP3122.tmp
C:\WINDOWS\DUMP3154.tmp
C:\WINDOWS\DUMP3155.tmp
C:\WINDOWS\DUMP3163.tmp
C:\WINDOWS\DUMP31be.tmp
C:\WINDOWS\DUMP320f.tmp
C:\WINDOWS\DUMP323c.tmp
C:\WINDOWS\DUMP32eb.tmp
C:\WINDOWS\DUMP32f8.tmp
C:\WINDOWS\DUMP3529.tmp
C:\WINDOWS\DUMP38b3.tmp
C:\WINDOWS\DUMP3901.tmp
C:\WINDOWS\DUMP3911.tmp
C:\WINDOWS\DUMP3912.tmp
C:\WINDOWS\DUMP394f.tmp
C:\WINDOWS\DUMP395f.tmp
C:\WINDOWS\DUMP396f.tmp
C:\WINDOWS\DUMP397e.tmp
C:\WINDOWS\DUMP3a3a.tmp
C:\WINDOWS\DUMP3c2e.tmp
C:\WINDOWS\DUMP3c7d.tmp
C:\WINDOWS\DUMP3c8c.tmp
C:\WINDOWS\DUMP3de3.tmp
C:\WINDOWS\DUMP3f1c.tmp
C:\WINDOWS\DUMP42f4.tmp
C:\WINDOWS\DUMP445c.tmp
C:\WINDOWS\DUMP470b.tmp
C:\WINDOWS\DUMP471b.tmp
C:\WINDOWS\DUMP471c.tmp
C:\WINDOWS\DUMP472a.tmp
C:\WINDOWS\DUMP474a.tmp
C:\WINDOWS\DUMP4778.tmp
C:\WINDOWS\DUMP4798.tmp
C:\WINDOWS\DUMP47b7.tmp
C:\WINDOWS\DUMP47e6.tmp
C:\WINDOWS\DUMP47f5.tmp
C:\WINDOWS\DUMP4805.tmp
C:\WINDOWS\DUMP4806.tmp
C:\WINDOWS\DUMP4815.tmp
C:\WINDOWS\DUMP4816.tmp
C:\WINDOWS\DUMP4824.tmp
C:\WINDOWS\DUMP4834.tmp
C:\WINDOWS\DUMP4835.tmp
C:\WINDOWS\DUMP4863.tmp
C:\WINDOWS\DUMP4864.tmp
C:\WINDOWS\DUMP4865.tmp
C:\WINDOWS\DUMP48a1.tmp
C:\WINDOWS\DUMP48b1.tmp
C:\WINDOWS\DUMP48d0.tmp
C:\WINDOWS\DUMP48ff.tmp
C:\WINDOWS\DUMP495d.tmp
C:\WINDOWS\DUMP49bb.tmp
C:\WINDOWS\DUMP4a18.tmp
C:\WINDOWS\DUMP4ac4.tmp
C:\WINDOWS\DUMP4bce.tmp
C:\WINDOWS\DUMP4c89.tmp
C:\WINDOWS\DUMP4d93.tmp
C:\WINDOWS\DUMP50b0.tmp
C:\WINDOWS\DUMP50cf.tmp
C:\WINDOWS\system32\awtsrb.exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\RCX24A.tmp
C:\WINDOWS\system32\VundoFixSVC.exe
.

((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))
.

2008-02-05 11:42 . 2008-02-05 11:42 d——– C:\WINDOWS\system32\LogFiles
2008-02-04 20:09 . 2004-08-04 00:00 388,608 –a—— C:\kmd.exe
2008-02-02 23:22 . 2008-02-02 23:25 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-02 23:18 . 2008-02-03 19:26 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-02 18:25 . 2008-02-02 19:45 d——– C:\VundoFix Backups
2008-01-30 19:52 . 2008-02-04 16:35 15,360 –a—— C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-01-30 19:52 . 2008-02-04 16:35 15,360 –a—— C:\WINDOWS\system32\ctfmon.exe
2008-01-30 19:34 . 2008-01-30 19:34 d–hs—- C:\found.001
2008-01-28 23:26 . 2008-01-28 23:26 d——– C:\Program Files\Kaspersky Lab
2008-01-28 23:26 . 2008-02-06 18:48 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-28 23:06 . 2008-01-28 23:06 d——– C:\kav
2008-01-28 21:42 . 2008-01-28 21:42 d——– C:\Documents and Settings\All Users\Application Data\CA
2008-01-28 21:41 . 2008-01-28 23:12 d——– C:\Program Files\Common Files\Scanner
2008-01-28 20:15 . 2007-10-10 15:55 6,065,664 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-28 20:15 . 2007-06-30 19:36 991,232 ——— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-28 20:15 . 2007-10-10 15:55 459,264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-28 20:15 . 2007-10-10 15:55 267,776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-28 20:15 . 2007-10-10 15:55 52,224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-28 20:15 . 2007-10-10 02:59 13,824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-28 20:14 . 2007-06-30 19:31 2,455,488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-28 20:14 . 2007-10-10 15:55 383,488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-28 20:14 . 2007-10-10 15:55 63,488 ——— C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-21 14:26 . 2008-01-21 14:26 d——– C:\Documents and Settings\Administrator.ANABOOK\Application Data\PC Tools
2008-01-21 14:23 . 2005-04-29 05:11 d——– C:\Documents and Settings\Administrator.ANABOOK\Application Data\Symantec
2008-01-21 14:23 . 2005-04-29 05:02 d——– C:\Documents and Settings\Administrator.ANABOOK\Application Data\Apple Computer
2008-01-20 21:18 . 2008-01-20 21:18 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-20 21:18 . 2008-01-20 21:18 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-20 21:10 . 2008-01-20 21:10 d——– C:\Documents and Settings\Hugh Smith\Application Data\Image Zone Express
2008-01-20 21:04 . 2001-08-17 13:56 7,552 –a—— C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2008-01-20 21:04 . 2001-08-17 13:56 7,552 –a—— C:\WINDOWS\system32\dllcache\sonypvu1.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 03:20 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-05 18:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\VMware
2008-02-05 18:38 ——— d—–w C:\Documents and Settings\LocalService\Application Data\VMware
2008-02-05 05:42 ——— d—–w C:\Program Files\QuickTime
2008-02-04 04:33 ——— d—–w C:\Program Files\Spyware Doctor
2008-02-03 21:39 ——— d—–w C:\Program Files\Java
2008-02-03 07:22 ——— d—–w C:\Program Files\Lavasoft
2008-01-21 15:24 94,208 —-a-w C:\WINDOWS\DUMP32ea.tmp
2008-01-21 15:22 94,208 —-a-w C:\WINDOWS\DUMP2f51.tmp
2008-01-21 15:21 94,208 —-a-w C:\WINDOWS\DUMP327a.tmp
2008-01-21 15:19 94,208 —-a-w C:\WINDOWS\DUMP302b.tmp
2008-01-21 15:18 94,208 —-a-w C:\WINDOWS\DUMP2e93.tmp
2008-01-21 15:17 94,208 —-a-w C:\WINDOWS\DUMP2da9.tmp
2008-01-21 15:15 94,208 —-a-w C:\WINDOWS\DUMP2e46.tmp
2008-01-21 15:13 94,208 —-a-w C:\WINDOWS\DUMP3162.tmp
2008-01-21 15:12 94,208 —-a-w C:\WINDOWS\DUMP2d49.tmp
2008-01-21 15:10 94,208 —-a-w C:\WINDOWS\DUMP2f50.tmp
2008-01-21 15:09 94,208 —-a-w C:\WINDOWS\DUMP2d78.tmp
2008-01-21 15:07 94,208 —-a-w C:\WINDOWS\DUMP31fc.tmp
2008-01-21 15:06 94,208 —-a-w C:\WINDOWS\DUMP2f41.tmp
2008-01-21 15:04 94,208 —-a-w C:\WINDOWS\DUMP2f01.tmp
2008-01-21 15:03 94,208 —-a-w C:\WINDOWS\DUMP30b5.tmp
2008-01-21 15:01 94,208 —-a-w C:\WINDOWS\DUMP2f71.tmp
2008-01-21 15:00 94,208 —-a-w C:\WINDOWS\DUMP2f2e.tmp
2008-01-21 14:58 94,208 —-a-w C:\WINDOWS\DUMP30c5.tmp
2008-01-21 14:57 94,208 —-a-w C:\WINDOWS\DUMP2f70.tmp
2008-01-21 14:55 94,208 —-a-w C:\WINDOWS\DUMP32bc.tmp
2008-01-21 14:54 94,208 —-a-w C:\WINDOWS\DUMP2ef1.tmp
2008-01-21 14:52 94,208 —-a-w C:\WINDOWS\DUMP31a2.tmp
2008-01-21 14:51 94,208 —-a-w C:\WINDOWS\DUMP2f5f.tmp
2008-01-21 14:49 94,208 —-a-w C:\WINDOWS\DUMP3153.tmp
2008-01-21 14:48 94,208 —-a-w C:\WINDOWS\DUMP2fad.tmp
2008-01-21 14:46 94,208 —-a-w C:\WINDOWS\DUMP2df7.tmp
2008-01-21 14:45 94,208 —-a-w C:\WINDOWS\DUMP323b.tmp
2008-01-21 14:43 94,208 —-a-w C:\WINDOWS\DUMP31a1.tmp
2008-01-21 14:42 94,208 —-a-w C:\WINDOWS\DUMP2d3b.tmp
2008-01-21 14:40 94,208 —-a-w C:\WINDOWS\DUMP2e55.tmp
2008-01-21 14:39 94,208 —-a-w C:\WINDOWS\DUMP2ee3.tmp
2008-01-21 14:37 94,208 —-a-w C:\WINDOWS\DUMP2d3a.tmp
2008-01-21 14:36 94,208 —-a-w C:\WINDOWS\DUMP3086.tmp
2008-01-21 14:34 94,208 —-a-w C:\WINDOWS\DUMP32d8.tmp
2008-01-21 14:33 94,208 —-a-w C:\WINDOWS\DUMP2f7c.tmp
2008-01-21 14:31 94,208 —-a-w C:\WINDOWS\DUMP2de7.tmp
2008-01-21 14:30 94,208 —-a-w C:\WINDOWS\DUMP3103.tmp
2008-01-21 14:28 94,208 —-a-w C:\WINDOWS\DUMP2f8d.tmp
2008-01-21 14:27 94,208 —-a-w C:\WINDOWS\DUMP3347.tmp
2008-01-21 14:25 94,208 —-a-w C:\WINDOWS\DUMP3393.tmp
2008-01-21 14:24 94,208 —-a-w C:\WINDOWS\DUMP32e9.tmp
2008-01-21 14:22 94,208 —-a-w C:\WINDOWS\DUMP31ee.tmp
2008-01-21 14:21 94,208 —-a-w C:\WINDOWS\DUMP3117.tmp
2008-01-21 14:19 94,208 —-a-w C:\WINDOWS\DUMP33f0.tmp
2008-01-21 14:18 94,208 —-a-w C:\WINDOWS\DUMP32f7.tmp
2008-01-21 14:16 94,208 —-a-w C:\WINDOWS\DUMP2de6.tmp
2008-01-21 14:15 94,208 —-a-w C:\WINDOWS\DUMP30b4.tmp
2008-01-21 14:13 94,208 —-a-w C:\WINDOWS\DUMP3161.tmp
2008-01-21 14:12 94,208 —-a-w C:\WINDOWS\DUMP2df6.tmp
2008-01-21 14:10 94,208 —-a-w C:\WINDOWS\DUMP43bf.tmp
2008-01-21 14:09 94,208 —-a-w C:\WINDOWS\DUMP324c.tmp
2008-01-21 14:07 94,208 —-a-w C:\WINDOWS\DUMP2e07.tmp
2008-01-21 14:06 94,208 —-a-w C:\WINDOWS\DUMP32a8.tmp
2008-01-21 14:05 94,208 —-a-w C:\WINDOWS\DUMP3116.tmp
2008-01-21 14:03 94,208 —-a-w C:\WINDOWS\DUMP302a.tmp
2008-01-21 14:02 94,208 —-a-w C:\WINDOWS\DUMP2e06.tmp
2008-01-21 14:00 94,208 —-a-w C:\WINDOWS\DUMP321d.tmp
2008-01-21 13:59 94,208 —-a-w C:\WINDOWS\DUMP2f4f.tmp
2008-01-21 13:57 94,208 —-a-w C:\WINDOWS\DUMP2e25.tmp
2008-01-21 13:56 94,208 —-a-w C:\WINDOWS\DUMP2ed4.tmp
2008-01-21 13:54 94,208 —-a-w C:\WINDOWS\DUMP31ed.tmp
2008-01-21 13:53 94,208 —-a-w C:\WINDOWS\DUMP32bb.tmp
2008-01-21 13:51 94,208 —-a-w C:\WINDOWS\DUMP2f4e.tmp
2008-01-21 13:50 94,208 —-a-w C:\WINDOWS\DUMP30a5.tmp
2008-01-21 13:48 94,208 —-a-w C:\WINDOWS\DUMP3289.tmp
2008-01-21 13:47 94,208 —-a-w C:\WINDOWS\DUMP2ef0.tmp
2008-01-21 13:45 94,208 —-a-w C:\WINDOWS\DUMP2f40.tmp
2008-01-21 13:44 94,208 —-a-w C:\WINDOWS\DUMP3346.tmp
2008-01-21 13:42 94,208 —-a-w C:\WINDOWS\DUMP2df5.tmp
2008-01-21 13:41 94,208 —-a-w C:\WINDOWS\DUMP3175.tmp
2008-01-21 13:40 94,208 —-a-w C:\WINDOWS\DUMP320e.tmp
2008-01-21 13:38 94,208 —-a-w C:\WINDOWS\DUMP2e54.tmp
2008-01-21 13:37 94,208 —-a-w C:\WINDOWS\DUMP31df.tmp
2008-01-21 13:35 94,208 —-a-w C:\WINDOWS\DUMP301b.tmp
2008-01-21 13:34 94,208 —-a-w C:\WINDOWS\DUMP2e35.tmp
2008-01-21 13:32 94,208 —-a-w C:\WINDOWS\DUMP31de.tmp
2008-01-21 13:31 94,208 —-a-w C:\WINDOWS\DUMP2da8.tmp
2008-01-21 13:29 94,208 —-a-w C:\WINDOWS\DUMP3115.tmp
2008-01-21 13:28 94,208 —-a-w C:\WINDOWS\DUMP301a.tmp
2008-01-21 13:26 94,208 —-a-w C:\WINDOWS\DUMP2e72.tmp
2008-01-21 13:25 94,208 —-a-w C:\WINDOWS\DUMP3160.tmp
2008-01-21 13:23 94,208 —-a-w C:\WINDOWS\DUMP3077.tmp
2008-01-21 13:22 94,208 —-a-w C:\WINDOWS\DUMP2ee2.tmp
2008-01-21 13:20 94,208 —-a-w C:\WINDOWS\DUMP32e8.tmp
2008-01-21 13:19 94,208 —-a-w C:\WINDOWS\DUMP2fe9.tmp
2008-01-21 13:17 94,208 —-a-w C:\WINDOWS\DUMP2e45.tmp
2008-01-21 13:16 94,208 —-a-w C:\WINDOWS\DUMP32d7.tmp
2008-01-21 13:14 94,208 —-a-w C:\WINDOWS\DUMP3019.tmp
2008-01-21 13:13 94,208 —-a-w C:\WINDOWS\DUMP2d88.tmp
2008-01-21 13:11 94,208 —-a-w C:\WINDOWS\DUMP2ff9.tmp
2008-01-21 13:10 94,208 —-a-w C:\WINDOWS\DUMP31d0.tmp
2008-01-21 13:08 94,208 —-a-w C:\WINDOWS\DUMP325b.tmp
2008-01-21 13:07 94,208 —-a-w C:\WINDOWS\DUMP2f6f.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-04 19:48 1694208]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-04 16:35 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2008-02-04 19:48 339968]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2008-01-26 23:34 794624]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2008-02-04 19:48 102492]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-30 16:44 692316]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2008-01-30 15:15 649728]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2008-01-30 15:15 233534]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2008-01-30 15:15 253952]
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2008-02-04 19:48 712704]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2008-02-04 19:48 81920]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2008-02-04 19:48 49152]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-30 16:43 180269]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [ ]
"eTrustPPAP"="C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe" [ ]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant .exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-02-04 19:48 83608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2006-02-05 09:04 2115728]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe [2005-12-15 11:40:44 282624]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-20 10:15:54 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2004-10-13 15:04 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-01-23 08:24 436736 C:\Program Files\QuickTime\qttask.exe

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 07:18]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-06 19:24:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe??????????????a??p???? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZinw12.exe
.
**************************************************************************
.
Completion time: 2008-02-06 19:30:44 - machine was rebooted [Hugh Smith]
ComboFix-quarantined-files.txt 2008-02-07 03:30:36
ComboFix2.txt 2008-02-05 04:31:35
.
2008-02-01 16:10:21 — E O F —

********************************************************** end combo fix log ************************************************************

*******************************************************HJT log **************************************************************************

Logfile of HijackThis v1.99.1
Scan saved at 19:33, on 2008-02-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant .exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O15 - Trusted Zone: http://www.vectorvest.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} - http://www.vectorvest.com/install/vvonlineusnew/install.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

******************************************************** END HJT LOG **********************************************************************

Trevuren,

to finish the cleanup I I removed the quicktime extensions. I fould a folder of pestpatrol items and deleted them. The program was not in the add/remove list.

I saw a commaid entry and requested to remove it. I got a message saying it was already gone did I want to take it off the list. responded yes.

I saw a "search enhancer " on the list and asked for it to be removed.
I saw a shopper helper(or something about shopping. asked for that to be removed.

I ran the combo fix script and it didnt complete. I have included the log below. Then I ran a hjt scan and included the log below.

maybe I should delete the spyware doctor also? I am thinking that maybe some of the HP routines are corrupted?

The system is better now but I am ready to continue until its completely cleaned up. Thanks.

************************************** combofix log *****************************************************************************
ComboFix 08-02.05.3 - Hugh Smith 2008-02-07 19:28:33.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.18 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hugh Smith\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\found.001
C:\kmd.exe
C:\WINDOWS\DUMP2d3a.tmp
C:\WINDOWS\DUMP2d3b.tmp
C:\WINDOWS\DUMP2d49.tmp
C:\WINDOWS\DUMP2d78.tmp
C:\WINDOWS\DUMP2d88.tmp
C:\WINDOWS\DUMP2da8.tmp
C:\WINDOWS\DUMP2da9.tmp
C:\WINDOWS\DUMP2de6.tmp
C:\WINDOWS\DUMP2de7.tmp
C:\WINDOWS\DUMP2df5.tmp
C:\WINDOWS\DUMP2df6.tmp
C:\WINDOWS\DUMP2df7.tmp
C:\WINDOWS\DUMP2e06.tmp
C:\WINDOWS\DUMP2e07.tmp
C:\WINDOWS\DUMP2e25.tmp
C:\WINDOWS\DUMP2e35.tmp
C:\WINDOWS\DUMP2e45.tmp
C:\WINDOWS\DUMP2e46.tmp
C:\WINDOWS\DUMP2e54.tmp
C:\WINDOWS\DUMP2e55.tmp
C:\WINDOWS\DUMP2e72.tmp
C:\WINDOWS\DUMP2e93.tmp
C:\WINDOWS\DUMP2ed4.tmp
C:\WINDOWS\DUMP2ee2.tmp
C:\WINDOWS\DUMP2ee3.tmp
C:\WINDOWS\DUMP2ef0.tmp
C:\WINDOWS\DUMP2ef1.tmp
C:\WINDOWS\DUMP2f01.tmp
C:\WINDOWS\DUMP2f2e.tmp
C:\WINDOWS\DUMP2f40.tmp
C:\WINDOWS\DUMP2f41.tmp
C:\WINDOWS\DUMP2f4e.tmp
C:\WINDOWS\DUMP2f4f.tmp
C:\WINDOWS\DUMP2f50.tmp
C:\WINDOWS\DUMP2f51.tmp
C:\WINDOWS\DUMP2f5f.tmp
C:\WINDOWS\DUMP2f6f.tmp
C:\WINDOWS\DUMP2f70.tmp
C:\WINDOWS\DUMP2f71.tmp
C:\WINDOWS\DUMP2f7c.tmp
C:\WINDOWS\DUMP2f8d.tmp
C:\WINDOWS\DUMP2fad.tmp
C:\WINDOWS\DUMP2fe9.tmp
C:\WINDOWS\DUMP2ff9.tmp
C:\WINDOWS\DUMP3019.tmp
C:\WINDOWS\DUMP301a.tmp
C:\WINDOWS\DUMP301b.tmp
C:\WINDOWS\DUMP302a.tmp
C:\WINDOWS\DUMP302b.tmp
C:\WINDOWS\DUMP3077.tmp
C:\WINDOWS\DUMP3086.tmp
C:\WINDOWS\DUMP30a5.tmp
C:\WINDOWS\DUMP30b4.tmp
C:\WINDOWS\DUMP30b5.tmp
C:\WINDOWS\DUMP30c5.tmp
C:\WINDOWS\DUMP3103.tmp
C:\WINDOWS\DUMP3115.tmp
C:\WINDOWS\DUMP3116.tmp
C:\WINDOWS\DUMP3117.tmp
C:\WINDOWS\DUMP3153.tmp
C:\WINDOWS\DUMP3160.tmp
C:\WINDOWS\DUMP3161.tmp
C:\WINDOWS\DUMP3162.tmp
C:\WINDOWS\DUMP3175.tmp
C:\WINDOWS\DUMP31a1.tmp
C:\WINDOWS\DUMP31a2.tmp
C:\WINDOWS\DUMP31d0.tmp
C:\WINDOWS\DUMP31de.tmp
C:\WINDOWS\DUMP31df.tmp
C:\WINDOWS\DUMP31ed.tmp
C:\WINDOWS\DUMP31ee.tmp
C:\WINDOWS\DUMP31fc.tmp
C:\WINDOWS\DUMP320e.tmp
C:\WINDOWS\DUMP321d.tmp
C:\WINDOWS\DUMP323b.tmp
C:\WINDOWS\DUMP324c.tmp
C:\WINDOWS\DUMP325b.tmp
C:\WINDOWS\DUMP327a.tmp
C:\WINDOWS\DUMP3289.tmp
C:\WINDOWS\DUMP32a8.tmp
C:\WINDOWS\DUMP32bb.tmp
C:\WINDOWS\DUMP32bc.tmp
C:\WINDOWS\DUMP32d7.tmp
C:\WINDOWS\DUMP32d8.tmp
C:\WINDOWS\DUMP32e8.tmp
C:\WINDOWS\DUMP32e9.tmp
C:\WINDOWS\DUMP32ea.tmp
C:\WINDOWS\DUMP32f7.tmp
C:\WINDOWS\DUMP3346.tmp
C:\WINDOWS\DUMP3347.tmp
C:\WINDOWS\DUMP3393.tmp
C:\WINDOWS\DUMP33f0.tmp
C:\WINDOWS\DUMP43bf.tmp
.
/wow section not completed


*************************************************** end combo fix log *******************************************************************

**************************************************** hjt log ******************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 20:07, on 2008-02-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant .exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O15 - Trusted Zone: http://www.vectorvest.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} - http://www.vectorvest.com/install/vvonlineusnew/install.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

******************************************************** end hjt log **********************************************************************

I am pretty sure that Unlocker and its remnants are causing the problems. I see a registry for it remains in your Hijackhis log. I can not spend much time online tonight. Please do the following:

A. 1. Go to Start->Run and type in notepad and hit OK.

2. Then copy and paste the content of the following codebox into Notepad:

@Echo off
FOR %%G IN (
C:\WINDOWS\DUMP*.tmp
) DO (
attrib -r -h -s %%G
del /q /f %%G
)
del delete.bat

3. Save the file to your DESKTOP as "delete.bat". Make sure to save it with the quotes. It should look like this on your desktop: [external image: Posted Image]

4. Double click delete.bat.


B. Please download Deckard's System Scanner (DSS) to your desktop.

• Close all applications and windows.
• Double-click on dss.exe to run it, and follow the prompts.
• When the scan is complete, a text file will open - Main.txt
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of Main.txt in your thread in the HijackThis Log Help Forum.
• An additional text file, Extra.txt,will also be available (by default) in the following FOLDER, C:\Deckard\System Scanner.
• Please go to that FOLDER and also copy the contents of Extra.txt to your post as well.

Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

What DSS will do:

• Create a new System Restore point in Windows XP and Vista.
• Clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
• Check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed.

Post Logs:

• DSS Scan Results: contents of 1) Main.txt and 2) Extra.txt

C. Please do not do anything more on your own.

Trevuren,

(a) ran delete.bat

( ran dss.exe and posted both logs below

© ok,got it.

************************************************** deckards main.txt ****************************************************************

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-02-08 03:17:22
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
16: 2008-02-08 11:17:45 UTC - RP461 - Deckard's System Scanner Restore Point
15: 2008-02-08 03:27:05 UTC - RP460 - ComboFix created restore point
14: 2008-02-07 04:46:13 UTC - RP459 - Removed Google Earth
13: 2008-02-07 03:11:50 UTC - RP458 - ComboFix created restore point
12: 2008-02-07 00:07:27 UTC - RP457 - System Checkpoint


– First Restore Point –
1: 2008-01-30 18:10:52 UTC - RP446 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Percentage of Memory in Use: 76% (more than 75%).
Total Physical Memory: 223 MiB (512 MiB recommended).


– HijackThis (run as Hugh Smith.exe) ——————————————

Unable to find log (file not found); running clone.
– HijackThis Clone ————————————————————


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-02-08 03:18:47
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Maxtor\OneTouch\Utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HPQ\Shared\hpqwmi.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Documents and Settings\Hugh Smith\Desktop\dss.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\Program Files\Spyware Doctor\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\Program Files\Spyware Doctor\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant .exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\Program Files\Spyware Doctor\tools\iesdpb.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.travelocity.com (HKCU)
O15 - Trusted Zone: http://www.vectorvest.com (HKCU)
O15 - Trusted Zone: https://www.vectorvest.com (HKCU)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} () - http://www.vectorvest.com/install/vvonlineusnew/install.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - Unknown owner - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe


–
End of file - 8608 bytes

– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

S3 NPPTNT2 - c:\windows\system32\npptnt2.sys