What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Need help...Firefox hijacked...maybe more?

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm having problems with my browser. I use Mozilla Firefox. Runs extremely slow. Pages are not even fully loading. And sometimes I get ads popping up as new tabs. I've run Spybot S&D and tried my best to get rid of the problem. But, it just doesn't seem to go away. I hope I didn't do any damage. I also have Norton Internet Security w/ AntiSpyware protection. It doesn't detect a thing. So, here I am. And here is my log… Please help. :pullhair:
Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 9:02:42 PM, on 5/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Smith Micro\StuffIt\ArcNameService.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\lxbxcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
D:\Program Files\Steam\Steam.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroDist.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
O4 - HKLM\..\Run: [f0951c5e] rundll32.exe "C:\WINDOWS\system32\wjgikmss.dll",b
O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [BMf3a62fc2] Rundll32.exe "C:\WINDOWS\system32\pjjcecjm.dll",s
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Steam] "D:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Append to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\ELBO\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.alienware.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {EF6E7E56-9229-4C73-AAD0-15316405DB95} (Easy Photo Uploader) - http://calba1.photosite.com/~site/UploadBo…oadBox_live.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9FD10F82-C80E-4E20-9B98-8704C1B48767}: NameServer = 205.152.144.23,205.152.132.23
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxbx_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbxcoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Stuffit Archive Name Service - Smith Micro Software, Inc. - C:\Program Files\Smith Micro\StuffIt\ArcNameService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #2
Hi elbonius76, and Welcome to WhatTheTech

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.


As I am still training, my posts to you will be checked by an Expert member. This will ensure that all advice and instructions I give you are accurate and safe. This may mean that my replies may take a little longer.
Post #3
elbonius76,

SPYBOT TEATIMER
  • Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
  • On the left hand side, click on Tools, then click on the Resident Icon in the list.
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • Click on the "System Startup" icon in the List
  • Uncheck the "TeaTimer" box and "OK" any prompts.
  • If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
  • Exit Spybot S&D when done.
  • (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]

Then

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Also "copy/paste" a new HijackThis log file into this thread.

The log can also be found here:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Also please describe how your computer behaves at the moment.
Post #4
Tomk,

Thank you for your help, sorry it took me a little to get back here. But, after unchecking the "Resident "TeaTimer" (Protection of overall system settings) active." box. And then clicking on the "System Startup" icon in the List, the Tea Timer is not on the list. But, if it is left checked in the Resident settings, it is on the start up list. So, are these conflicting steps? I don't want to move onto the next step if I shouldn't.
Hope that makes sense…please advise. :unsure:

Thank you.
Post #6
Tomk,

I followed your directions and my Malwarebytes' Log File and new HijackThis Log File are below.
My computer, and moreover, my browser seem to be working normally.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Malwarebytes' Anti-Malware 1.12
Database version: 753

Scan type: Quick Scan
Objects scanned: 54795
Time elapsed: 16 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 17
Registry Values Infected: 3
Registry Data Items Infected: 2
Folders Infected: 17
Files Infected: 219

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\efcYSMeb.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\jhonrsma.dll (Trojan.Vundo) -> Unloaded module successfully.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95074ecd-cc2f-439e-b337-1757300045a2} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{95074ecd-cc2f-439e-b337-1757300045a2} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0037d199-2070-4643-860d-e4b471b3f4b1} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cff1f9de-0153-41b7-a947-e5b146ed913f} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cef14066-d3d2-4ad0-a040-731a70476ea4} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7bf35b6f-822c-4030-b347-b68760697e2f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7bf35b6f-822c-4030-b347-b68760697e2f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{25982eaa-87cc-4747-be09-9913cf7dd2f1} (Adware.AdMedia) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f0951c5e (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{7bf35b6f-822c-4030-b347-b68760697e2f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMf3a62fc2 (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\efcysmeb -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\efcysmeb -> Delete on reboot.

Folders Infected:
C:\Program Files\WinBudget (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\de (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\en-GB (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\es (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\fr (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\it (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\pl (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources (Adware.AdMedia) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\efcYSMeb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\beMSYcfe.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\beMSYcfe.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jhonrsma.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\amsrnohj.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\malcewlk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\klweclam.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vtUmnkll.dll_old (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\llknmUtv.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\llknmUtv.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Budget License - Windows.rtf (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\BudgetAppIcon.ico (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\BudgetControls.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\BudgetDocIcon.ico (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\BudgetMainWindow.exe (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\eSellerateControl350.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\eSellerateEngine.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\Interop.ESELLERATECONTROL350Lib.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\Interop.Import.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\Matrix.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\MenuExtender.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\MessageBoxExLib.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\_Import.tlb (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\de\BudgetMainWindow.resources.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\en-GB\BudgetMainWindow.resources.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\es\BudgetMainWindow.resources.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\fr\BudgetMainWindow.resources.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\it\BudgetMainWindow.resources.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\bin\pl\BudgetMainWindow.resources.dll (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\ATM.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Balance.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Bank_Accounts.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Calc.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Calendar.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Cancel.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Cash.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Charge.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Check_Register.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Check_split.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Concept.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Credit.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Define_Pay.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Delete_Envelopes.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Delete_Transaction.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Deposit_split.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Editor.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Envelopes.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Envelope_Why.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Error.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Export.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Find.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Format.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Group_Envelopes.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\HelpInfo.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\History.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Income_Why.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\index.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Keep.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Make_Deposit.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Move_Accounts.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Move_Envelopes.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Multiple_Accounts.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Pay_Entry.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Pref.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Print_Check.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\QIF.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\QIF_Balance.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\QIF_Convert.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Register.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Reminder.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Reports.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Save_Backup.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Saving.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\SetupAssistant.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\SetupManual.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Shortcuts.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Standard_Data_Entry.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Started.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\StartedCredit.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Statistics.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\TableAmounts.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\ToDo.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Transfer.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Write_Check.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\Write_CreditCheck.html (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\ATM.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Balance.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\BankAccount1.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\BankAccount2.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\BankAccount3.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\BankAccount4.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\BudgetMain.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\BudgetMainMulti.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Calendar.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Charge.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Charge_Multi.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Check.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\checkerboard.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\CheckPrintSetup.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\CheckSelectingAccount.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Check_Multi.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\CreditCheck.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Deposit.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Deposit_Multi.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\EnvelopeAppearance.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\EnvelopeDelete.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\EnvelopeInfo.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\EnvelopeInfo_Info.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\EnvelopePaySetup.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Export.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Find.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\GroupEnv1.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\GroupEnv2.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\History.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\MainWindow_Checkbook.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\MainWindow_Empty.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\MainWindow_Savings.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\MainWindow_Total.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PayRecord.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PaySourcesEditAccount.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PaySourcesEditFreq.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PaySourcesEditName.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PrefsBackup.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PrefsCurrency.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PrefsGeneral.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PrefsIcons.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\PrefsUpdate.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Prefs_colors.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Prefs_general.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\QIFImport.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\QIFImportAccounts.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\QIF_Balance_Sheet.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\QIF_Record_Sheet.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Registration.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Reminder.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Reports.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SavingsCalc.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SetupAssistant_BankAccount.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SetupAssistant_BudgetSetup.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SetupAssistant_Distribute.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SetupAssistant_Envelopes.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SetupAssistant_Expenses.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SetupAssistant_Features.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SetupAssistant_Income.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\SetupAssistant_Intro.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\spacer.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Startup_MainWindow.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Startup_PaySource.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Startup_SplitDeposit.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Statistics3.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Transfer.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\TransferAvail.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\Help\images\Transfer_Multi.gif (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Info.plist (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\contents.xml (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon01.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon02.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon03.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon04.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon05.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon06.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon07.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon08.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon09.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon10.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon11.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon12.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon13.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon14.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon15.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon16.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon17.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon18.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon19.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon20.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon21.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon22.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon23.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon24.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon25.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon26.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon27.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon28.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon29.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built In Icons (B&W).budgeticons\Contents\Resources\Icon30.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Info.plist (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\contents.xml (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon01.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon02.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon03.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon04.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon05.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon06.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon07.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon08.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon09.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon10.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon11.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon12.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon13.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon14.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon15.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon16.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon17.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon18.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon19.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon20.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon21.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon22.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon23.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon24.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon25.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon26.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon27.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon28.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon29.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Icon30.png (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\Program Files\WinBudget\plugins\Built in Icons (Color).budgeticons\Contents\Resources\Snowflake.tiff (Adware.AdMedia) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vjjmhypk.dll (Trojan.Agent) -> Delete on reboot.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Logfile of HijackThis v1.99.1
Scan saved at 8:59:24 PM, on 5/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Smith Micro\StuffIt\ArcNameService.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\lxbxcoms.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {029595BB-0C39-473E-B129-2C42411679D2} - C:\WINDOWS\system32\fccyvVon.dll (file missing)
O2 - BHO: {1682e6e4-b3ad-00d9-4e14-3c69ba445c22} - {22c544ab-96c3-41e4-9d00-da3b4e6e2861} - C:\WINDOWS\system32\bwldyvxr.dll
O2 - BHO: (no name) - {348FE907-249E-4C65-A838-F34A193FE1D1} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6DF1C6BB-6572-4E29-9987-839AABFCDFF5} - C:\WINDOWS\system32\vtUmnkll.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C9123293-41DF-491F-80E8-BBA264CC8D92} - (no file)
O2 - BHO: (no name) - {CB78D6BD-D5C0-4AF6-AB80-EE85ABDE1783} - C:\WINDOWS\system32\ddcCTjHb.dll (file missing)
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Append to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\ELBO\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.alienware.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {EF6E7E56-9229-4C73-AAD0-15316405DB95} (Easy Photo Uploader) - http://calba1.photosite.com/~site/UploadBo…oadBox_live.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9FD10F82-C80E-4E20-9B98-8704C1B48767}: NameServer = 205.152.144.23,205.152.132.23
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: awtqqoNh - awtqqoNh.dll (file missing)
O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxbx_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbxcoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Stuffit Archive Name Service - Smith Micro Software, Inc. - C:\Program Files\Smith Micro\StuffIt\ArcNameService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Thank you… :popcorn:
Post #7
elbonius76,

Looking better but more to do.

A. Please download ComboFix by sUBs from HERE or HERE directly to your Desktop.

Note: If you already have ComboFix on your machine, please DELETE it from your desktop before downloading the newest version.

B.Go to [external image: Posted Image] -> Run -> copy/paste the following single line command in the runbox & click OK

"%userprofile%\desktop\combofix.exe" /killall

[external image: Posted Image]
  • DO NOT USE your computer for any other purpose while ComboFix is running.
  • ComboFix may restart your computer, this is normal.
  • When finished, it will produce a log, ComboFix.txt.
  • Please post ComboFix.txt in your next reply along with a new HijackThis log.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #8
Tomk, I ran Combofix about 8 times. It never finished. I followed your instructions to a T, but it seems to have stalled every time. Please advise. Thanks! :wacko:
Post #9
elbonius76,

Please delete Combofix from your desktop.


NORTON ANTIVIRUS
Please navigate to the system tray on the bottom right hand corner and look for a [external image: Posted Image] sign.
  • right-click it -> chose "Disable Auto-Protect."
  • select a duration of 5 hours (this assures no interference with the cleanup of your pc)
  • click "Ok."
  • a popup will warn that protection will now be disabled and the sign will now look like this: [external image: Posted Image]
You succesfully disabled the Norton Antivirus Guard.

Now please download the current version of Combofix and follow previous instructions.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI