This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] e404

39 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

everytime i perform a scan, a threat called e404 appears, i remove it but when i reboot the computer it re-appears, how do i get rid of it permently?
Hello blair07

Welcome to the Whatthetech Malware Removal Forum,



Download Trendmicros Hijackthis to your desktop.
Double click it to install
Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe
  • Open HJT Scan and Save a Log File, it will open in Notepad
  • Go to Format and make sure Wordwrap is Unchecked
  • Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread by using the Post Reply and not start a New Thread.
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:21:52, on 20/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\Virgin Net Broadband\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\WinAnonymous\stm.exe
C:\PROGRA~1\COMMON~1\WINSEC~1\gac.exe
C:\Program Files\WinAnonymous\GDC.exe
C:\Program Files\Common Files\CryptDrive\cdcw.exe
C:\Program Files\Common Files\System Doctor\dcmon.exe
C:\Program Files\WinSecureAv\pgs.exe
C:\Program Files\CryptDrive\cdr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CryptDrive\BlockEng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\WinAnonymous\data\GDCW.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! UK & Ireland
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CIEIntegrator Object - {5C3F6257-3E00-45C2-88D5-CB0F3A17BF0E} - C:\Program Files\WinSecureAv\Tools\pblock.dll
O2 - BHO: IEFW Object - {6F87F145-DC2D-4766-AF03-3A3B96FFAD98} - C:\Program Files\WinSecureAv\Tools\sbiebho.dll
O2 - BHO: 375013 helper - {74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B} - C:\WINDOWS\system32\375013\375013.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: CryptDrive toolbar - {46008301-AF55-4788-9834-28B182CD6DAA} - C:\Program Files\CryptDrive\CDTbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [bm] "C:\Program Files\Common Files\WinSecureAv\bm.exe" dm=http://winsecureav.com ad=http://winsecureav.com sd=http://ykeeper.winsecureav.com
O4 - HKLM\..\Run: [ptask] C:\Program Files\WinSecureAv\ptask.exe
O4 - HKLM\..\Run: [NI.NTP+_0001_N93E0404] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\startup15fbb6ef-dddb-4e0e-b2ac-718a5b4d1cb9.exe" -nag
O4 - HKLM\..\Run: [gdcw] C:\Program Files\WinAnonymous\data\GDCW.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAnonymous\stm.exe" dm=http://winanonymous.com ad=http://winanonymous.com sd=http://ilp.winanonymous.com
O4 - HKLM\..\Run: [gac] "C:\PROGRA~1\COMMON~1\WINSEC~1\gac.exe" -start
O4 - HKLM\..\Run: [WinAnonymous] C:\Program Files\WinAnonymous\GDC.exe
O4 - HKLM\..\Run: [NI.UGDC_0001_N127M1004] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\installer_en.exe"
O4 - HKLM\..\Run: [cdcw] "C:\Program Files\Common Files\CryptDrive\cdcw.exe" -c
O4 - HKLM\..\Run: [BMN] "C:\Program Files\Common Files\WinSecureAv\bm.exe" dm=http://winsecureav.com ad=http://winsecureav.com sd=http://ykeeper.winsecureav.com
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Common Files\WinAntiVirus Pro 2007\mav_startupmon.exe" dm=http://winantivirus.com ad=http://winantivirus.com sd=http://ulog.winantivirus.com
O4 - HKLM\..\Run: [NI.UGDC_0001_N129M0605] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\installer_en.exe"
O4 - HKLM\..\Run: [USS] "C:\Program Files\USS\USS.exe"
O4 - HKLM\..\Run: [BMN(1)] "C:\Program Files\Common Files\System Doctor\dcmon.exe" dm=http://systemdoctor.com ad=http://systemdoctor.com sd=http://log.systemdoctor.com/
O4 - HKLM\..\Run: [SystemDoctor Free] C:\Program Files\System Doctor Free\systemdoc.exe /min
O4 - HKLM\..\Run: [WinSecureAv] C:\Program Files\WinSecureAv\pgs.exe
O4 - HKLM\..\Run: [NetTurboPro] C:\Program Files\NetTurboPro\ntp.exe
O4 - HKLM\..\Run: [CryptDrive] C:\Program Files\CryptDrive\cdr.exe /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WinSpyKiller] C:\Program Files\WinSpyKiller\WinSpyKiller.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Media Card Companion Monitor.lnk = C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Stan James Poker.com Poker - {7F2F6F5A-CAE2-4954-A461-36B3757B2BFB} - C:\Program Files\stanjamesgibMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O22 - SharedTaskScheduler: important - {9c87cb31-93d0-4f3e-a360-4a91ff77aeb7} - C:\WINDOWS\system32\dcggain.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 11740 bytes
Hello Blair,

Whats going on here is that you have a few Rogue Anti Spyware programs installed that are infact Trojans that have infected your system, we are going to have to run a few tools to get rid of them all, lets run this one first. When were done, will link you to some free programs to install to help keep you secure, but please don't download anymore Spyware programs that you find on the internet, a lot of them are bogus

This tool needs to be run from Safemode to be effective so download it to your desktop then boot to Safemode to run it

To Enter Safemode

  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
Tutorial if you need it How to boot into Safemode


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
SDFix: Version 1.195
Run by [removed] on 20/06/2008 at 16:01

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
dhlp

Path :
System32\Drivers\dhlp.sys

dhlp - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\Documents and Settings\Compaq_Owner\Application Data\WinSecureAv\activator_info.txt - Deleted
C:\Documents and Settings\Compaq_Owner\Application Data\WinSecureAv\AVScheduler.dat - Deleted
C:\Documents and Settings\Compaq_Owner\Application Data\WinSecureAv\DownloadGA6P.url - Deleted
C:\Documents and Settings\Compaq_Owner\Application Data\WinSecureAv\PGE.dat - Deleted
C:\Documents and Settings\Compaq_Owner\Application Data\WinSecureAv\Logs\Activate.log - Deleted
C:\Documents and Settings\Compaq_Owner\Application Data\WinSecureAv\Logs\threats.log - Deleted
C:\Documents and Settings\Compaq_Owner\Application Data\WinSecureAv\Logs\update.log - Deleted
C:\Documents and Settings\All Users\Start Menu\Programs\WinSecureAv\Contact Customer Support.lnk - Deleted
C:\Documents and Settings\All Users\Start Menu\Programs\WinSecureAv\Reinstall or Uninstall WinSecureAv.lnk - Deleted
C:\Documents and Settings\All Users\Start Menu\Programs\WinSecureAv\WinSecureAv Knowledge base.lnk - Deleted
C:\Documents and Settings\All Users\Start Menu\Programs\WinSecureAv\WinSecureAv Manual.lnk - Deleted
C:\Documents and Settings\All Users\Start Menu\Programs\WinSecureAv\WinSecureAv.lnk - Deleted
C:\Documents and Settings\All Users\Desktop\WinSecureAv.lnk - Deleted
C:\Documents and Settings\All Users\Start Menu\Programs\WinSecureAv\WinSecureAv.lnk - Deleted
C:\Program Files\AntiMalwareGuard\amg.exe - Deleted
C:\Program Files\AntiMalwareGuard\WL.dat - Deleted
C:\Program Files\WinSecureAv\Activate.exe - Deleted
C:\Program Files\WinSecureAv\al.dat - Deleted
C:\Program Files\WinSecureAv\avisup.exe - Deleted
C:\Program Files\WinSecureAv\dhlp.dll - Deleted
C:\Program Files\WinSecureAv\FWSettings.bin - Deleted
C:\Program Files\WinSecureAv\history.db - Deleted
C:\Program Files\WinSecureAv\Logs - Deleted
C:\Program Files\WinSecureAv\main.log - Deleted
C:\Program Files\WinSecureAv\manual.pdf - Deleted
C:\Program Files\WinSecureAv\pgs.exe - Deleted
C:\Program Files\WinSecureAv\ptask.exe - Deleted
C:\Program Files\WinSecureAv\reload.exe - Deleted
C:\Program Files\WinSecureAv\ResErrors.log - Deleted
C:\Program Files\WinSecureAv\scnkrnl.dll - Deleted
C:\Program Files\WinSecureAv\settings.ini - Deleted
C:\Program Files\WinSecureAv\sqlite3.dll - Deleted
C:\Program Files\WinSecureAv\sr.log - Deleted
C:\Program Files\WinSecureAv\unins000.dat - Deleted
C:\Program Files\WinSecureAv\unins000.exe - Deleted
C:\Program Files\WinSecureAv\unwizard.exe - Deleted
C:\Program Files\WinSecureAv\Config\Activate.xml - Deleted
C:\Program Files\WinSecureAv\Config\pgs.xml - Deleted
C:\Program Files\WinSecureAv\Config\UnWiz.xml - Deleted
C:\Program Files\WinSecureAv\Dat\Activate.dat - Deleted
C:\Program Files\WinSecureAv\Dat\BkSites.dat - Deleted
C:\Program Files\WinSecureAv\Dat\cd.dat - Deleted
C:\Program Files\WinSecureAv\Dat\incmp.dat - Deleted
C:\Program Files\WinSecureAv\Dat\index.dat - Deleted
C:\Program Files\WinSecureAv\Dat\ps.dat - Deleted
C:\Program Files\WinSecureAv\Dat\pv.dat - Deleted
C:\Program Files\WinSecureAv\Engines\AWBase\vbpv.dat - Deleted
C:\Program Files\WinSecureAv\Engines\AWBase\database\enemies.dat - Deleted
C:\Program Files\WinSecureAv\Engines\PGBase\vbpv.dat - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\BORLNDMM.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANADWR.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANBCDR.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANDLDR.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANDOS1.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANEMUL.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANFUNC.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANKRNL.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANMCR1.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANOTHR.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANSCR.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANTOOL.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANTROJ.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\SCANWIN1.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UNACPU.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UNADBX.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\unamscan.dll - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UNMIME.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UNPACK.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UNPACKS.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UNPACKS2.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UNPEPACK.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\vbpv.dat - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UpDate\UA27601.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UpDate\UA27602.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UpDate\UA27603.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UpDate\UA27604.DLL - Deleted
C:\Program Files\WinSecureAv\Engines\plugins\UpDate\UADAILY.DLL - Deleted
C:\Program Files\WinSecureAv\Graphics\cross.gif - Deleted
C:\Program Files\WinSecureAv\Graphics\ga6p.gif - Deleted
C:\Program Files\WinSecureAv\Graphics\kb.url - Deleted
C:\Program Files\WinSecureAv\Graphics\main.ico - Deleted
C:\Program Files\WinSecureAv\Graphics\mini.ico - Deleted
C:\Program Files\WinSecureAv\Graphics\Online.url - Deleted
C:\Program Files\WinSecureAv\Graphics\support.ico - Deleted
C:\Program Files\WinSecureAv\Graphics\Support.url - Deleted
C:\Program Files\WinSecureAv\Graphics\uninstall.ico - Deleted
C:\Program Files\WinSecureAv\La\lapv.dat - Deleted
C:\Program Files\WinSecureAv\La\License.rtf - Deleted
C:\Program Files\WinSecureAv\La\Readme.rtf - Deleted
C:\Program Files\WinSecureAv\Tools\pblock.dll - Deleted
C:\Program Files\WinSecureAv\Tools\sbiebho.dll - Deleted
C:\Program Files\WinSecureAv\Up\ASupdater.dat - Deleted
C:\Program Files\WinSecureAv\Up\diagnosis.dat - Deleted
C:\Program Files\WinSecureAv\Up\gup.exe - Deleted
C:\Program Files\WinSecureAv\Up\PGupdater.dat - Deleted
C:\Program Files\WinSecureAv\Up\UBupdater.dat - Deleted
C:\Program Files\WinSecureAv\Up\up.dat - Deleted
C:\Program Files\WinSecureAv\Up\updater.dat - Deleted
C:\Program Files\Common Files\WinSecureAv\avInst.exe - Deleted
C:\Program Files\Common Files\WinSecureAv\gac.exe - Deleted
C:\Program Files\Common Files\WinSecureAv\unicoWS.dll - Deleted
C:\WINDOWS\system32\375013\375013.dll - Deleted
C:\WINDOWS\system32\drivers\dhlp.sys - Deleted



Folder C:\Documents and Settings\Compaq_Owner\Application Data\WinSecureAv - Removed
Folder C:\Documents and Settings\All Users\Application Data\SalesMon - Removed
Folder C:\Documents and Settings\All Users\Start Menu\Programs\WinSecureAv - Removed
Folder C:\Program Files\AntiMalwareGuard - Removed
Folder C:\Program Files\WinSecureAv - Removed
Folder C:\Program Files\Common Files\WinSecureAv - Removed
Folder C:\WinSecureAv - Removed
Folder C:\WINDOWS\system32\375013 - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-20 16:09:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000009c
"TracesSuccessful"=dword:00000002

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\yahoo!\\messenger\\ypager.exe\""="C:\\Program Files\\yahoo!\\messenger\\ypager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :


Finished!
Great, moving right along.

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.<– Don't forget this
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and Paste the entire report in your next reply along with a Hijackthis log.
Thanks for all your help so far, As requested Malwarebytes' Anti-Malware 1.18 Database version: 871 17:12:18 20/06/2008 mbam-log-6-20-2008 (17-12-18).txt Scan type: Quick Scan Objects scanned: 39397 Time elapsed: 13 minute(s), 14 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 28 Registry Values Infected: 5 Registry Data Items Infected: 0 Folders Infected: 35 Files Infected: 530 Memory Processes Infected: C:\Program Files\WinAnonymous\GDC.exe (Rogue.Multiple) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{9c87cb31-93d0-4f3e-a360-4a91ff77aeb7} (Trojan.Zlob) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{2a5c2e6d-864b-4f2c-9542-8b272741d78b} (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{459f4226-1aab-43b6-9dc1-b6313ef83749} (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{6f520be0-9b54-4558-816f-224e67997df3} (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{0ebacaf2-e0f9-47a9-98cf-0ecce30b654c} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{0ebacaf2-e0f9-47a9-98cf-0ecce30b654c} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{14e6d991-db22-4661-981d-20c168d6847b} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2242513c-f5e9-41b3-bc89-4d9daf487450} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3b489b37-fc1b-45c8-b1ce-78d9aef5b336} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3d6a6e24-fdff-418e-a93d-9fbdcba377af} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e318e44-0c35-4292-af91-18dd17795636} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{495349a3-3a35-465f-88df-6ccfc1348246} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{575e8879-d6cf-4992-a7fe-651da9277bcb} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{76a15001-ff88-47ee-9e34-9f68e34246af} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{819a1c55-735f-4696-8727-3772ec87ad26} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{8dc7e656-ffbc-4ba2-af81-1c6c4fe04407} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{a86bed71-2b56-4778-9c48-829a3d01c687} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{ae119e11-cf86-43cb-91aa-1acf2bbf9ec6} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b5a1ce7f-011d-4475-98db-076aaf3b1d18} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b667f141-171c-4ac6-bd2b-8e0c646fb920} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{da4f8351-05ef-4956-b9ab-1093b732436f} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e1e4e46d-53b8-45dc-abf0-3e7adef79012} (Rogue.VirusHeat) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Purchased Products (Rogue.Multiple) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\WinAnonymous (Rogue.WinAnonymous) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\WinAnonymous (Rogue.WinAnonymous) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Secure Delete (Rogue.SecurePCCleaner) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\uwap7.pcheck.1 (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\WinAntiVirus Pro 2007 (Rogue.WinAntivirus) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinAnonymous (Rogue.Multiple) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{9c87cb31-93d0-4f3e-a360-4a91ff77aeb7} (Trojan.Zlob) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run\SystemDoctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootStera (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\ZangoToolbar 4.8.2 (Adware.Zango) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\Common Files\WinAntiVirus Pro 2007 (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007 (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\UWA7P (Unknown.Vundo.Related) -> Quarantined and deleted successfully. C:\UWA7P\Quar (Unknown.Vundo.Related) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\firefox (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\mozilla (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\netscape (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\opera (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\Download (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\plug (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\WinAnonymous (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\WinAnonymous (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\Common Files\WinAnonymous (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\Common Files\System Doctor (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\SafeMedia (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\SafeMedia\Mp3DB (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\SafeMedia\MpegDB (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\SafeMedia\WaveDB (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007 (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007\Logs (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAnonymous (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAnonymous\Logs (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\System Doctor Free\Logs (Rogue.SystemDoctor) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\WinAnonymous\GDC.exe (Rogue.Multiple) -> Quarantined and deleted successfully. C:\WINDOWS\system32\packet.dll (Spyware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sqlite3.dll (Rogue.Multiple) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wpcap.dll (Spyware.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\install_en[1].exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Program Files\Common Files\WinAntiVirus Pro 2007\err.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\config.ini (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\default.ini (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\diagnosis.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\GDC.url (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\last_report.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\License.rtf (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\manual.chm (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\ps.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\Readme.rtf (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\runtime (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\Scan_report.htm (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\Support.exe (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\unins000.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\unins000.exe (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\updater.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\updater.exe (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\ver.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\brand.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\GDCW.exe (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\sfl.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\skin.skn (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\srl.dat (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\7-Zip Compression Pgm.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\AbsoluteFTP.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\ACDSee32.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Acoustica CD Label Maker.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ad-aware SE.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adaptec Easy CD Creator v4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adaptec's Audio CD.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Addsoft.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\AddWeb 3.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Acrobat Reader v3.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Acrobat Reader v3.1.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Acrobat Reader v4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Acrobat Reader v5.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Acrobat Reader v6.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Acrobat Reader v7.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Photoshop v5.0 LE.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Photoshop v5.5.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Photoshop v6.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Adobe Photoshop v7.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Advanced Disk Catalog.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Advanced MP3 Catalog.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Advanced Password Recovery.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\ahead cover designer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Albatros ADGaspect.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Albatros ADGpano.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Albatros ADGview.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Alcohol MRU List.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Animation Shop 1.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Animation Shop 3.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\AOL - Spool.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\ASPack.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Avant Browser.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\AX-Icons 4.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Axialis Icon Workshop 5.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Axialis Media Browser.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Babylon Builder 2.2.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Babylon Translator.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\BlazeDVD 2.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Bookreader.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\C++ Builder.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Cabinet Manager.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Chameleon Web Browser.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Classify 98.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Clicktionary 2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\CoffeeCup DirectFTP.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\CoffeeCup GIF Animator.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Cool Edit 2000 1.1.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Cool Edit Pro.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Corel PhotoPaint 8.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\CrissCross.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\CRT 2.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Cute FTP v3.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Cute FTP v4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Cute MX.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\CuteFTP.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\CuteHTML.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\DataRescue_IDA.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Delphi v3.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Delphi v4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Delphi v5.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Delphi v7.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Disk Explorer Professional 3.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Diskeeper 5.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\DivX Player.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Download Accelerator.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ebay Toolbar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\EditPad.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\EditPlus 2.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\edonkey2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\eMule.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Enfish Onespace.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Enigma Browser.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\F-Secure SSH 2.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Fix-It 2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\FlashGet.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\FotoCanvas 2.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Fotostation 4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\foxit reader.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Free Download Manager 1.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\FTP Explorer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\FTP Voyager.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Fun CD.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Gator.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\GeoVid Video to Flash Batch Converter.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\GetRight ExplorerBar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\GetRight.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Go!Zilla.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Google Deskbar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Google Desktop Search History.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Google Toolbar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Google Video Player 1.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\GoZilla.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Gravity Newsreader.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\hardcopy.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Helios TextPad v3.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Helios TextPad v4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\HelpWriter.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\hexworkshop.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Homesite 4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Hotbar 3.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\HotJava Browser.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\HTML Help Workshop.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Icon Extractor.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\iMesh.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\InoculatelT PE Antivirus.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\InstallShield Express.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\InterQuick.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Irfanview.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Iso Buster.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Jasc Animation Shop 3.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\JASC Paintshop Pro v5.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\JASC Paintshop Pro v6.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\JASC Paintshop Pro v7.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\JASC Paintshop Pro v8.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Jet Photo Shell.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\juno.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\K-Lite Codec Pack.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Kazaa Media Desktop.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Kodak Imaging.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\LeapFTP 2.6.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\LeechFTP.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Letterbox.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\LViewPro 2.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Macromedia Dreamweaver MX.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Macromedia Dreamweaver Ultradev 4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Macromedia Firework MX.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Macromedia Fireworks 3.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Macromedia Flash MX.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Macromedia Flash Player.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Macromedia Flash v4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Magic ISO Maker 4.6.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\mapinfo mapmarker.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Mass Download.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MasterSplitter v2.1.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\McAfee Virus Scan.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MEDA MP3 Splitter.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Metapad.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MGI PHOTOSUITE SE 1.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MGUSOFT Setup Builder.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microangelo 98.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MicroAngelo.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Micrografx Picture Publisher v7.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Micrografx Picture Publisher v8.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft FrontPage Express.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft FrontPage.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Help Workshop.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft HTML Help.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Imaging.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Managemant Console.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Netmeeting.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Office 2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Office 2003.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Office 97.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Office InfoPath 2003.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Office XP.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Office.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Outlook Express 5.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Photo Editor 3.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MicroSoft PhotoDraw.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Picture It Publishing.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Publisher 2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Visual Studio 6.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Windows Paint.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Windows WordPad.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Word 2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Word Backup Files.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Microsoft Works 4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Mijenix Powerdesk 4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MIRC.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\miroMEDIA PCTV.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\mixmeister.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Morpheus.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MovieXone 1.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Mozart 4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\ms autoroute express.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MS WORD.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MSE.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MSN Toolbar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Music Match Jukebox.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\MyWay Advertising.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Napster Music Community.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Naviscope.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\NEATO Labels.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\nero burning rom.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Nero Vision.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Net Vampire 3.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\netants.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\NetCaptor.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\netmeeting.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Netsonic.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Netzip Download Demon 3.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\NewsBin Pro 4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Norton AntiVirus 2000 (v6).scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Norton AntiVirus 2003.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Norton Commander.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Norton File Manager.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Norton Firewall.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Norton Internet Security.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Norton LiveUpdate.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Norton Utilities 2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\NotePad Plus.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\notetab lite.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\NoteTab Pro.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Object Rescue.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\OmniPage 10.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\OnTrack Powerdesk 4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ontrack PowerDesk 5.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PackageForTheWeb.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Paint Shop Pro 5.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Paint Shop Pro 7.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Password Safe.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PE Explorer 1.95.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Personal Ancestral File.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\photo magic 4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PhotoCanvas 2.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Photodex Compupic Pro.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PhotoDraw 2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PhotoImpact 8.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PhotoImpact Viewer 4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PicoZip.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PictureIt Digital Image Pro 7.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PKZip for Windows v2.60.03+.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PolyView.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Popup Purger.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PopUpCop.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Power archiver.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PowerArc.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PowerDVD.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PowerZip.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Privacy Eraser Pro.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Putty hostkeys.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\PYTHON.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\QuickTime.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Real Audio Player v6 v7 v8.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Real Download v4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\RealNetworks Real Download.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\RealOne & RealPlayer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\RealVNC.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\RegEdit.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Roxio Easy CD Creator.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Save Now.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Scour Exchange.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Seal Module Mlayer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SearchAndBrowse.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SearchAnt.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SearchV.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SearchWolf.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SearchWWW.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SideStep.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Skype.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Smart Explorer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SmartDraw 6.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\smartftp.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SmartPops.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Sonic Foundry's Acid 2.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Sonique Player.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Spinner Plus.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SpotOn Browser plugin.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Staff-FTP.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Star Downloader.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Stardialer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\StarOffice 5.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SubmitWolf Pro.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Sun Java Cache.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SureThing CD Labeler.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SVAPlayer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\SWiSH 2.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Teleport Pro.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Telnet.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Text Pad 4.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\The Playa.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Third Voice 1.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Thumbs Plus 4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Timesink.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\TinyBar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\TOPicks.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Total Commander.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\transponder.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Trellians Classify 98.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Tribal Voice's PowWow.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Trojan Remover.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\TSADBOT.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\UCmore toolbar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ulead Gif Animator v4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ulead GIF Animator v5.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ulead Photo Explorer v4.2.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ulead Photo Express.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ulead PhotoImpact v5.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ulead VideoStudio 4.0.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Ultimate Paint.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\ULTImate Technology BV v5.5.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\UltraEdit v4.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\UltraEdit v7.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\UltraEdit.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\UltraISO 7.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\uTorrent 1.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\VBoxEdit.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\VirtualDub.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\VMWARE.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Vueprint.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\VX2 Respondmiter.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\W32Dasm.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Web Ferret v3.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WebFerret.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\webhancer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Wildstylz.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WildTangent.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WinAce.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\winamp.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Windows Commander.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WinHTTrack Website Copier.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WinOnCD.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WinRar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Winshow.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WinUAE.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Winupie.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WinVNC.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WinZip v8.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Wise Installer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Worm.Sobig.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\WurldMedia.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Xara 3D v4.x.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Xara Webstyle.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\XDialer.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\XING MP3 PLAYER.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\XLoader.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Xolox.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Xrenoder.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Xupiter toolbar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Xzoomy.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Yahoo Player.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Yahoo! Toolbar.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Yamaha S-YXG100.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\ZeroPopup.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\ZipMagic 2000.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\application\Zone Alarm.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\firefox\Firefox - Cache.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\firefox\Firefox - Cookies.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\firefox\Firefox - History.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\ie cookies.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\ie internet cache.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\ie privacy history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\ie typed urls.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\ie url history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\windows autocomplete.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\windows downloaded files.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\windows favorites order.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\ie\windows passwords.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\aim.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\AOL Bart.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\AOL Instant Messenger.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\aolim.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\icq - download.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\icq - logs.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\Miranda ICQ.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\MSN Messenger User Account.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\Trillian cache.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\trillian downloads.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\trillian logs.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\yahoo messenger logs.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\messanger\Yahoo! Messenger.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\mozilla\mozilla - autocomplete.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\mozilla\mozilla - cache.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\mozilla\mozilla - cookies.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\mozilla\Mozilla - history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\mozilla\mozilla - saved passwords.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\mozilla\Mozilla - typed urls.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\netscape\netscape - cache.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\netscape\netscape - cookies.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\netscape\netscape - history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\netscape\Netscape Navigator - last trusted apps.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\opera\Opera Browser - cache.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\opera\Opera Browser - cookies.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\opera\Opera Browser - Download.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\opera\Opera Browser - history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\opera\Opera Browser - misc.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\opera\Opera Browser - mru.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\opera\Opera Browser - visited.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\Direct Draw.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\direct input.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\last files.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\Microsoft Send-To Extensions.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows applog.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows documents.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\Windows Downloaded Installations.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\Windows Empty Recycle Bin.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\Windows Explorer User Assistant history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows findfile.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\Windows FTP Accounts.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows hotfix uninstall.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows logfiles.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\Windows Mapped Drives.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows media player 7.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows minidump.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows MUICache.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows network links.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows opensave.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows openwith.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows prefetch.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows reg history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows run history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows search.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows start menu order.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows stream history.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows temp.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\windows update.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\data\windows\Windows XP Unread Mail Count.scr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\button_arrow.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\button_arrow2.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\buy.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\checked.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\custom.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\customcleanup.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\header.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_about.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_checked.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_grayed.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_link.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_manual.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_quit.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_support.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_unchecked.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_uncheked.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_uninstall.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\icon_update.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\log.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\logo.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\register.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\settings.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\sign_green.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\sign_green_big.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\sign_red.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\sign_red_big.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\sign_yellow.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\splash.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\status_good.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\status_risk.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\support.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\sysstatus.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\sys_shield.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\sys_update.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\unchecked.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\update.bmp (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\gfx\WindowsIconsMini.ico (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Arabic.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Brazilian.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Catalan.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Chinese.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Czech.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Danish.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Dutch.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\English.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Finnish.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\French.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\German.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Greek.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Hebrew.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Italian.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Japanese.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Malayan.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Norwegian.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Polish.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Portuguese.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Russian.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Slovenian.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Spanish.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Swedish.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Thai.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\lang\Turkish.lng (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\plug\GDCW.exe (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\plug\IH.exe (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\plug\sr.log (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\WinAnonymous\plug\stpHlpr.dll (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\WinAnonymous\Abbr (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\WinAnonymous\prod_code (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\WinAnonymous\Contact Customer Service.lnk (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\WinAnonymous\Uninstall WinAnonymous.lnk (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\WinAnonymous\WinAnonymous Manual.lnk (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\WinAnonymous\WinAnonymous web page.lnk (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\WinAnonymous\WinAnonymous.lnk (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\Common Files\WinAnonymous\stm.exe (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Program Files\Common Files\System Doctor\dcmon.exe (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\mfc71.dll (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\msvcp71.dll (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\msvcr71.dll (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\st.dat (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\systemdoc.exe (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007\avtasks.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007\CookieList.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007\history.db (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007\PGE.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007\Logs\update.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAntiVirus Pro 2007\Logs\winav.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\WinAnonymous\Logs\update.log (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\System Doctor Free\Logs\update.log (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\WinAnonymous.lnk (Rogue.WinAnonymous) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Desktop\WinAnonymous.lnk (Rogue.WinAnonymous) -> Quarantined and deleted successfully.
Ken,

As requested

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:26:26, on 20/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\Virgin Net Broadband\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\CryptDrive\cdcw.exe
C:\Program Files\CryptDrive\cdr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\CryptDrive\BlockEng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! UK & Ireland
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: CryptDrive toolbar - {46008301-AF55-4788-9834-28B182CD6DAA} - C:\Program Files\CryptDrive\CDTbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [NI.NTP+_0001_N93E0404] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\startup15fbb6ef-dddb-4e0e-b2ac-718a5b4d1cb9.exe" -nag
O4 - HKLM\..\Run: [gac] "C:\PROGRA~1\COMMON~1\WINSEC~1\gac.exe" -start
O4 - HKLM\..\Run: [NI.UGDC_0001_N127M1004] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\installer_en.exe"
O4 - HKLM\..\Run: [cdcw] "C:\Program Files\Common Files\CryptDrive\cdcw.exe" -c
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Common Files\WinAntiVirus Pro 2007\mav_startupmon.exe" dm=http://winantivirus.com ad=http://winantivirus.com sd=http://ulog.winantivirus.com
O4 - HKLM\..\Run: [NI.UGDC_0001_N129M0605] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\installer_en.exe"
O4 - HKLM\..\Run: [USS] "C:\Program Files\USS\USS.exe"
O4 - HKLM\..\Run: [NetTurboPro] C:\Program Files\NetTurboPro\ntp.exe
O4 - HKLM\..\Run: [CryptDrive] C:\Program Files\CryptDrive\cdr.exe /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WinSpyKiller] C:\Program Files\WinSpyKiller\WinSpyKiller.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Media Card Companion Monitor.lnk = C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Stan James Poker.com Poker - {7F2F6F5A-CAE2-4954-A461-36B3757B2BFB} - C:\Program Files\stanjamesgibMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 9937 bytes
I have been at this for many years and I work a lot of logs that people have installed a Rogue program not knowing it was bad, what you have done here is to download and install every piece of garbage that has come along, its a wonder your system even starts up. I am not trying to make you feel bad, I just am trying to make you aware of the garbage you have installed and if you continue your going to get to a point where a reformat of windows and a clean install is going to be needed, not a whole lot of fun :blush:


Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

All this is garbage
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: CryptDrive toolbar - {46008301-AF55-4788-9834-28B182CD6DAA} - C:\Program Files\CryptDrive\CDTbar.dll

O4 - HKLM\..\Run: [NI.NTP+_0001_N93E0404] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\startup15fbb6ef-dddb-4e0e-b2ac-718a5b4d1cb9.exe" -nag
O4 - HKLM\..\Run: [NI.UGDC_0001_N127M1004] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\installer_en.exe" G
O4 - HKLM\..\Run: [cdcw] "C:\Program Files\Common Files\CryptDrive\cdcw.exe" -c G
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Common Files\WinAntiVirus Pro 2007\mav_startupmon.exe" dm=http://winantivirus.com ad=http://winantivirus.com sd=http://ulog.winantivirus.com G
O4 - HKLM\..\Run: [NI.UGDC_0001_N129M0605] "C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\installer_en.exe"
O4 - HKLM\..\Run: [CryptDrive] C:\Program Files\CryptDrive\cdr.exe /min
O4 - HKCU\..\Run: [WinSpyKiller] C:\Program Files\WinSpyKiller\WinSpyKiller.exe




Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall


Post the Combofix log and a New HJT log please
Ken,

Here is the New HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:05:23, on 20/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\Virgin Net Broadband\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\CryptDrive\BlockEng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! UK & Ireland
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [gac] "C:\PROGRA~1\COMMON~1\WINSEC~1\gac.exe" -start
O4 - HKLM\..\Run: [USS] "C:\Program Files\USS\USS.exe"
O4 - HKLM\..\Run: [NetTurboPro] C:\Program Files\NetTurboPro\ntp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Media Card Companion Monitor.lnk = C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Stan James Poker.com Poker - {7F2F6F5A-CAE2-4954-A461-36B3757B2BFB} - C:\Program Files\stanjamesgibMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 8897 bytes

Am having problems downloading combofix, i keep receiving the following message,

You cannot rename ComboFix as ComboFix(1)

Please use another name, preferbaly made up of alphanumeric characters.

Thanks

Blair
Sorry Ken, but when i use the 1st link i receive this message, C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\H63C8LG5\ComboFix(2). exe is not a valid Win32 application not sure how to rename it if the file doesn't save, sorry Blair
Ken,

As requested

ComboFix 08-06-19.4 - Compaq_Owner 2008-06-20 20:44:16.1 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFixNew.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\Compaq_Owner\err.log
C:\Documents and Settings\Compaq_Owner\ResErrors.log
C:\WINDOWS\system32\cfx32.ocx
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\pthreadVC.dll
D:\Autorun.inf

—– BITS: Possible infected sites —–

hxxp://assist.talktalk.net
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_FOPN
——-\Legacy_NPF
——-\Service_NPF


((((((((((((((((((((((((( Files Created from 2008-05-20 to 2008-06-20 )))))))))))))))))))))))))))))))
.

2008-06-20 16:51 . 2008-06-20 16:51 d——– C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
2008-06-20 16:50 . 2008-06-20 16:50 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-06-20 16:50 . 2008-06-20 16:50 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-20 16:50 . 2008-06-19 17:48 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-20 16:50 . 2008-06-19 17:47 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-06-20 15:58 . 2008-06-20 15:58 d——– C:\WINDOWS\ERUNT
2008-06-20 15:36 . 2008-06-20 16:12 d——– C:\SDFix
2008-06-20 12:21 . 2008-06-20 12:21 d——– C:\Program Files\Trend Micro
2008-06-14 10:18 . 2008-06-13 14:10 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-06-14 10:18 . 2008-06-13 14:10 272,128 —–c— C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-27 18:40 . 2008-05-27 18:41 d——– C:\Program Files\USS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-20 10:57 ——— d—–w C:\Program Files\Nick Arcade
2008-06-20 10:56 ——— d—–w C:\Program Files\PF.Magic
2008-06-20 10:55 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-20 10:44 ——— d—–w C:\Program Files\DivX
2008-06-19 15:43 ——— d—–w C:\Program Files\Disney Interactive
2008-06-19 15:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Disney Interactive
2008-06-19 15:42 ——— d—–w C:\Program Files\Europress
2008-06-19 15:42 ——— d—–w C:\Program Files\Daily Star Sci-Fi Saturday
2008-06-19 15:40 ——— d—–w C:\Program Files\THQ
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-26 17:22 ——— d—–w C:\Documents and Settings\Compaq_Owner\Application Data\CryptDrive
2008-04-25 22:26 ——— d—–w C:\Program Files\Microsoft Works
2008-04-25 22:26 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-04-25 22:26 ——— d—–w C:\Program Files\Betfair Poker
2008-04-25 18:03 ——— d—–w C:\Program Files\CryptDrive
2008-04-25 18:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\CryptDrive
2008-04-25 17:49 ——— d—–w C:\Program Files\Common Files\CryptDrive
2008-04-25 17:36 ——— d—–w C:\Program Files\McAfee.com
2008-04-25 17:20 704,280 —-a-w C:\Documents and Settings\Compaq_Owner\Application Data\driveclean-upinstallfull_en[1].exe
2008-04-25 17:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-04-25 17:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2008-04-25 17:12 ——— d—–w C:\Program Files\McAfee
2008-04-06 17:09 181,016 —-a-w C:\Documents and Settings\Compaq_Owner\Application Data\antivirusinstallfull_en[1].exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe" [2004-01-01 11:07 159744]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 17:33 126976]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-21 19:11 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-01 09:51 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 16:51 118784]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-04-21 19:28 286720]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472]
"VTTimer"="VTTimer.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2003-12-09 00:18 70776]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 12:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 14:54 241664]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:21 406016]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 23:32 53248]
"SoundMan"="SOUNDMAN.EXE" [2005-04-06 18:57 90112 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2005-04-06 18:53 2805248 C:\WINDOWS\ALCWZRD.EXE]
"SpeedTouch USB Diagnostics"="C:\Program Files\Virgin Net Broadband\Dragdiag.exe" [2004-01-26 11:38 866816]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-01-01 10:45 98304]
"TalkTalk"="C:\Program Files\TalkTalk\bin\sprtcmd.exe" [2005-08-16 01:12 192512]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 17:44 61440]
"gac"="C:\PROGRA~1\COMMON~1\WINSEC~1\gac.exe" [ ]
"USS"="C:\Program Files\USS\USS.exe" [2008-03-25 19:31 143360]
"NetTurboPro"="C:\Program Files\NetTurboPro\ntp.exe" [2008-01-24 19:36 585728]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 23:31:38 241664]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-29 00:06:36 53248]
Media Card Companion Monitor.lnk - C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe [2005-12-28 13:50:37 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= vdrcodec.dll
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"vidc.VP31"= vp31vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

R1 DrvPrt;DrvPrt;C:\WINDOWS\system32\drivers\drvprt.sys [2003-11-26 14:26]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

.
Contents of the 'Scheduled Tasks' folder
"2004-12-25 12:02:17 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-20 20:50:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\savedump.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
.
**************************************************************************
.
Completion time: 2008-06-20 20:54:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-20 19:54:28

Pre-Run: 38,077,820,928 bytes free
Post-Run: 38,023,917,568 bytes free

150 — E O F — 2008-06-20 15:20:35
Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Folder::

Folder::
C:\Program Files\CryptDrive
C:\Documents and Settings\All Users\Application Data\CryptDrive
C:\Program Files\Common Files\CryptDrive
C:\PROGRA~1\COMMON~1\WINSEC~1

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gac"=-

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.




You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit these files for analysis, just use the BROWSE feature and then Send File , you will get a report back, post the report into this thread for me to see.

C:\Documents and Settings\Compaq_Owner\Application Data\driveclean-upinstallfull_en[1].exe
C:\Documents and Settings\Compaq_Owner\Application Data\antivirusinstallfull_en[1].exe


Post the New Combofix log, the VirusTotal reports and a New HJT log please

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI