Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode Be sure to update AVG Anti- Spyware Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode Go to start> control panel> add/ remove programs> and uninstall this program: Lime Wire Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - {303D3FCA-0BEC-4F86-B245-E66DEBC10BA4} - C:\WINDOWS\system32\khfdc.dll (file missing) O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O20 - Winlogon Notify: khfdc - C:\WINDOWS\system32\khfdc.dll (file missing) O20 - Winlogon Notify: winkxq32 - winkxq32.dll (file missing) O21 - SSODL: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - C:\WINDOWS\system32\gwquvw.dll Exit Hijack This but remain in safe mode. Run Killbox from safe mode. Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): :\WINDOWS\system32\gwquvw.dll C:\Program Files\Key Generator\pmmon.exe C:\WINDOWS\SYSTEM32\vbar332.dll C:\WINDOWS\system32\khfdc.dll C:\WINDOWS\system32\winkxq32.dll Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. Open notepad (Start Menu > Run > Type notepad and press "ok". Copy and paste everything into notepad between the x's making regedit4 the top line. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{8d8c2387-7f80-4022-9be6-43630a969558}"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "carbinyl"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfdc] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winkxq32] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop. Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes. Reboot into safe mode. Navigate to and delete this folder if found C:\Program Files\Key Generator < Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Post the AVG-Anti Spyware report on your desktop, a new combofix log and a new Hijack This log please.

0

Here is the AVG Report! AVG Anti-Spyware - Scan Report + Created at: 12:20:19 AM 1/7/2007 + Scan result: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On -> Adware.Generic : No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 -> Adware.Generic : No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 -> Adware.IntCodec : No action taken. HKU\S-1-5-21-1873989314-319406743-3767655610-1005\Software\Internet Security -> Adware.IntCodec : No action taken. C:\!KillBox\Update.exe -> Downloader.Small : No action taken. :mozilla.128:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.129:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.130:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.131:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.146:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.149:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.170:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.172:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.59:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.60:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.61:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.62:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.63:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.34:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.35:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.36:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.37:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.38:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.70:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.71:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.72:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.73:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.74:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.11:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Atdmt : No action taken. :mozilla.25:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Atdmt : No action taken. :mozilla.112:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.113:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.114:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.115:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.116:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.117:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.143:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.227:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.228:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.229:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.182:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Coremetrics : No action taken. :mozilla.23:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Doubleclick : No action taken. :mozilla.44:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Doubleclick : No action taken. :mozilla.204:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Esomniture : No action taken. :mozilla.138:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.139:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.140:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.141:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.181:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.182:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.183:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.184:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.189:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.22:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.24:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.26:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.27:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.28:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.121:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.122:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.123:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.84:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.85:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.86:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.87:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.88:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.89:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.90:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.152:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.153:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.154:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.156:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.158:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.159:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.160:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.164:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.166:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.167:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.190:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.191:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Liveperson : No action taken. :mozilla.192:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Liveperson : No action taken. :mozilla.193:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Liveperson : No action taken. :mozilla.194:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Liveperson : No action taken. :mozilla.10:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.152:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.153:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.9:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.181:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.55:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.56:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.57:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.58:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.72:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Realtracker : No action taken. :mozilla.73:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Realtracker : No action taken. :mozilla.168:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Ru4 : No action taken. :mozilla.169:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Ru4 : No action taken. :mozilla.163:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.164:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.172:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.173:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.174:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.94:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.165:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.166:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.104:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.105:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.106:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.107:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.108:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.109:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.110:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.52:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.53:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.54:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.55:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.56:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.57:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.58:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.99:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.12:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.13:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.14:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.15:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.16:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.17:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.18:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.19:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.20:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.21:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.22:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.24:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.25:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.26:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.27:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.28:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.29:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.30:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.8:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.91:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.92:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.93:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.100:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.101:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.102:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.103:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\Default User\90u6h7xh.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.39:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.40:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.41:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.42:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.43:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.44:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.47:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.48:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.49:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.50:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.51:C:\Documents and Settings\Kristen Mastrola\Application Data\Mozilla\Profiles\default\kibq8k52.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. ::Report end

0

Here is my HiJack This Report: Logfile of HijackThis v1.99.1 Scan saved at 12:24:05 AM, on 1/7/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Mozilla 1.7\mozilla.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [bascstray] BascsTray.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe" O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Picture Package Menu.lnk = ? O4 - Global Startup: Picture Package VCD Maker.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Documents and Settings\Kristen Mastrola\Desktop\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\System32\basfipm.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.exe

0

Here is my combofix log: Kristen Mastrola - 07-01-07 0:25:51.84 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Kristen Mastrola\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-12-07 to 2007-01-07 )))))))))))))))))))))))))))))))))) 2007-01-06 23:28 <DIR> d--hs---- C:\WINDOWS\CSC 2007-01-06 23:17 3,968 --a--c--- C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys 2007-01-06 21:40 4,678 --a--c--- C:\WINDOWS\SYSTEM32\tmp.reg 2007-01-06 21:39 79,360 --a--c--- C:\WINDOWS\SYSTEM32\swxcacls.exe 2007-01-06 21:39 53,248 --a--c--- C:\WINDOWS\SYSTEM32\Process.exe 2007-01-06 21:39 51,200 --a--c--- C:\WINDOWS\SYSTEM32\dumphive.exe 2007-01-06 21:39 40,960 --a--c--- C:\WINDOWS\SYSTEM32\swsc.exe 2007-01-06 21:39 288,417 --a--c--- C:\WINDOWS\SYSTEM32\SrchSTS.exe 2007-01-06 21:39 135,168 --a--c--- C:\WINDOWS\SYSTEM32\swreg.exe 2007-01-06 18:48 <DIR> d----c--- C:\Program Files\Grisoft 2007-01-03 18:38 21,456 --a--c--- C:\WINDOWS\SYSTEM32\DRIVERS\SilvrLnk.sys 2007-01-03 18:38 <DIR> d----c--- C:\Program Files\Common Files\TI Shared 2007-01-03 18:37 <DIR> d----c--- C:\Program Files\TI Education 2007-01-03 18:37 <DIR> d----c--- C:\Program Files\Common Files\Wise Installation Wizard 2006-12-26 23:09 77,824 --a--c--- C:\WINDOWS\SYSTEM32\msbind.dll 2006-12-26 23:09 508,928 --a--c--- C:\WINDOWS\SYSTEM32\msde.dll 2006-12-26 23:09 46,592 --a--c--- C:\WINDOWS\SYSTEM32\buyb12ex.dll 2006-12-26 23:09 40,960 --a--c--- C:\WINDOWS\SYSTEM32\FXDV1to2.dll 2006-12-26 23:09 363,008 --a--c--- C:\WINDOWS\SYSTEM32\BUYB12.dll 2006-12-26 23:09 <DIR> d----c--- C:\Program Files\Fx Video Converter 2006-12-26 23:01 33,920 --a--c--- C:\WINDOWS\SYSTEM32\DRIVERS\oreans32.sys 2006-12-26 23:00 638,976 --a--c--- C:\WINDOWS\SYSTEM32\divx.dll 2006-12-26 23:00 413,760 --a--c--- C:\WINDOWS\SYSTEM32\mpg4c32.dll 2006-12-26 23:00 261,632 --a--c--- C:\WINDOWS\SYSTEM32\mcdvd_32.dll 2006-12-26 23:00 <DIR> d----c--- C:\Program Files\Common Files\AVSMedia 2006-12-26 23:00 <DIR> d----c--- C:\Program Files\AVSMedia 2006-12-26 19:42 <DIR> d----c--- C:\Program Files\VideoraiPodConverter 2006-12-26 19:42 <DIR> d----c--- C:\Program Files\AviSynth 2.5 2006-12-26 19:24 28,672 --a--c--- C:\WINDOWS\SYSTEM32\AVEQ.dll 2006-12-26 19:24 <DIR> d----c--- C:\Program Files\Allok MPEG4 Converter 2006-12-26 19:23 <DIR> d----c--- C:\Program Files\Common Files\Download Manager (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-07 00:23 -------- d----c--- C:\Program Files\Hijackthis 2007-01-04 02:07 -------- d----c--- C:\Program Files\Common Files\Microsoft Shared 2007-01-04 02:01 -------- d----c--- C:\Program Files\Microsoft Office 2007-01-04 01:34 560 --a--c--- C:\Documents and Settings\Kristen Mastrola\Application Data\ViewerApp.dat 2007-01-04 01:08 6 --a--c--- C:\Documents and Settings\Kristen Mastrola\Application Data\dm.ini 2007-01-04 01:08 1543 --a--c--- C:\Documents and Settings\Kristen Mastrola\Application Data\AdobeDLM.log 2007-01-04 01:08 -------- d----c--- C:\Program Files\Adobe 2007-01-04 01:08 -------- d----c--- C:\Documents and Settings\Kristen Mastrola\Application Data\Adobe 2007-01-03 18:38 -------- d----c--- C:\Program Files\Common Files 2007-01-02 03:15 -------- d----c--- C:\Program Files\DVD Burning Xpress 2007-01-02 03:14 -------- d----c--- C:\Program Files\Snood 2007-01-02 03:14 -------- d----c--- C:\Program Files\Mozilla 1.7 2007-01-02 03:14 -------- d----c--- C:\Program Files\Modem Helper 2007-01-02 03:14 -------- d----c--- C:\Program Files\Messenger 2007-01-02 03:14 -------- d----c--- C:\Program Files\LimeWire 2007-01-02 03:14 -------- d----c--- C:\Program Files\Apoint 2007-01-02 03:14 -------- d----c--- C:\Program Files\AIM 2006-12-26 23:09 -------- d----c--- C:\Program Files\Common Files\DESIGNER 2006-12-26 17:14 -------- d---sc--- C:\Documents and Settings\Kristen Mastrola\Application Data\Microsoft 2006-12-26 17:09 2508 --a--c--- C:\Documents and Settings\Kristen Mastrola\Application Data\$_hpcst$.hpc 2006-12-26 17:07 -------- d----c--- C:\Program Files\Microsoft ActiveSync 2006-12-17 03:03 -------- d----c--- C:\Program Files\Internet Explorer 2006-12-17 03:01 -------- d----c--- C:\Program Files\Outlook Express 2006-12-17 03:01 -------- d----c--- C:\Program Files\Common Files\System 2006-12-07 17:02 2174976 --a--c--- C:\WINDOWS\SYSTEM32\wmvcore.dll 2006-11-18 15:11 -------- d----c--- C:\Program Files\Cake Mania 2006-11-16 03:01 -------- d----c--- C:\Program Files\MSXML 4.0 2006-11-12 15:25 -------- d----c--- C:\Program Files\MINITAB1420_5_mo_rental_R1 2006-11-08 00:06 679424 --a--c--- C:\WINDOWS\SYSTEM32\inetcomm.dll 2006-11-04 18:58 33702 --a--c--- C:\WINDOWS\SYSTEM32\xvid-uninstall.exe 2006-11-04 14:14 1245696 --a--c--- C:\WINDOWS\SYSTEM32\msxml4.dll 2006-10-19 08:56 713216 --a--c--- C:\WINDOWS\SYSTEM32\sxs.dll 2006-10-13 07:35 65536 --a--c--- C:\WINDOWS\SYSTEM32\nwwks.dll 2006-10-13 07:35 64000 --a--c--- C:\WINDOWS\SYSTEM32\nwapi32.dll 2006-10-13 07:35 142336 --a--c--- C:\WINDOWS\SYSTEM32\nwprovau.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "RealPlayer"="\"C:\\Program Files\\Real\\RealPlayer\\realplay.exe\" /RunUPGToolCommandReBoot" "H/PC Connection Agent"="\"C:\\PROGRA~1\\MICROS~3\\wcescomm.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /installquiet" "Apoint"="C:\\Program Files\\Apoint\\Apoint.exe" "bascstray"="BascsTray.exe" "Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe" "DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe" "AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\"" "IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "HP Software Update"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe\"" "ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE" "McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\" /StartedFromRunKey" "Network Associates Error Reporting Service"="\"C:\\Program Files\\Common Files\\Network Associates\\TalkBack\\tbmon.exe\"" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c2,01,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispAppearancePage"=dword:00000000 "NoColorChoice"=dword:00000000 "NoSizeChoice"=dword:00000000 "NoDispBackgroundPage"=dword:00000000 "NoDispScrSavPage"=dword:00000000 "NoDispCPL"=dword:00000000 "NoVisualStyleChoice"=dword:00000000 "NoDispSettingsPage"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoActiveDesktop"=dword:00000000 "NoSaveSettings"=dword:00000000 "ClassicShell"=dword:00000000 "NoThemesTab"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "DisableTaskMgr"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktopChanges"=dword:00000000 "AllowLegacyWebView"=dword:00000001 "AllowUnhashedWebView"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1092015847.job Completion time: 07-01-07 0:26:37.27 C:\ComboFix.txt ... 07-01-07 00:26 C:\ComboFix2.txt ... 07-01-06 21:57

0

Looks better. you did not get AVG-AntiSpyware set to quarantine, you should set it up to quarantine then run it again. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0