Hi everyone! I'm helping my friend fix his wife's laptop, but, my tech-knowledge only extends as far as running virus scans, etc... After so many scans from a multitude of softwares, I was successful in removing the X on the C drive, but, the POS.TMP files remain. Can anyone be so kind as to assist me with this? Thank you for your help and attention in this matter! Note: I already have a HijackThis logfile ready for posting when needed. Thank you!!

Discard any logs you have and run these scans please. Go to the this link: Disable Realtime Protection Follow their directions to disable any realtime protection that you have as it will interfere with the fix by reinstalling the corrupt files. Please download Atribune's VundoFix.exe from the following site to your desktop: Vundofix.exe Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click "yes". Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click "ok". Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required. Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log it produces.

Per your directions- HiJack This Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:47:27 PM, on 3/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\Explorer.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\hphmon05.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?T... O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {06D35B80-B281-423C-A6F3-8E123FA0971E} - C:\WINDOWS\system32\fcywu.dll (file missing) O2 - BHO: {f29031a8-5b21-ffc8-2214-996cca0f9c21} - {12c9f0ac-c699-4122-8cff-12b58a13092f} - C:\WINDOWS\system32\thpjbccg.dll (file missing) O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll O2 - BHO: (no name) - {6A46416F-2E3A-4F49-8001-7674C6FED971} - C:\Program Files\MSN\wykisafem89104.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [Tbsa] "C:\WINDOWS\ASKS~1\msiexec.exe" -vt ndrv O4 - HKCU\..\Run: [Jitcafrl] "C:\Program Files\Common Files\?ssembly\w?crtupd.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: RABCO - Auto Update.lnk = C:\Program Files\RABCO\RABCOse.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Display All Images with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/228" O8 - Extra context menu item: Display Image with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/227" O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g... O20 - Winlogon Notify: hggfgdd - hggfgdd.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe -- End of file - 7985 bytes ComboFix: ComboFix 08-03-10.1 - sally nguyen 2008-03-12 18:50:35.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.193 [GMT -6:00] Running from: C:\Documents and Settings\sally nguyen\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\LocalService\Application Data\NetMon C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt C:\Documents and Settings\NetworkService\Application Data\NetMon C:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt C:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt C:\Documents and Settings\sally nguyen\Application Data\ASKS~1 C:\Documents and Settings\sally nguyen\Start Menu\Programs\Outerinfo C:\Documents and Settings\sally nguyen\Start Menu\Programs\Outerinfo\Terms.lnk C:\Documents and Settings\sally nguyen\Start Menu\Programs\Outerinfo\Uninstall.lnk C:\Program Files\Common Files\crosof~1 C:\Program Files\Common Files\ssembl~1 C:\Program Files\outerinfo C:\Program Files\outerinfo\FF\chrome.manifest C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt C:\Program Files\outerinfo\FF\install.rdf C:\Program Files\outerinfo\Terms.rtf C:\Program Files\RABCO C:\Program Files\RABCO\ExecutionDll.dll C:\Program Files\RABCO\RABCO.dll.intermediate.manifest C:\Program Files\RABCO\RABCOse.info C:\Program Files\RABCO\RABCOse.original C:\Program Files\RABCO\Setup.log C:\Program Files\RABCO\un_RABCOSetup_16230.exe C:\Program Files\RABCO\un_RABCOSetup_16230.txt C:\Program Files\RABCO\X_RABCOse.log C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\isgTi19 C:\Temp\isgTi19\lPig.log C:\WINDOWS\asks~1 C:\WINDOWS\asks~1\?asks\ C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\nGpxx01 C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\spgfruqa.ini C:\WINDOWS\system32\tpoqweiy.ini C:\WINDOWS\system32\tyqlpclg.ini C:\WINDOWS\system32\uwycf.ini C:\WINDOWS\system32\uwycf.ini2 C:\WINDOWS\system32\winpfz37.sys C:\WINDOWS\system32\womrpmwm.ini C:\WINDOWS\system32\zxdnt3d.cfg . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\LEGACY_NETWORK_MONITOR -------\nm ((((((((((((((((((((((((( Files Created from 2008-02-13 to 2008-03-13 ))))))))))))))))))))))))))))))) . 2008-03-12 18:19 . 2008-03-12 18:19 <DIR> d-------- C:\VundoFix Backups 2008-03-08 02:58 . 2008-03-08 02:58 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-07 01:29 . 2008-03-07 01:29 <DIR> d-------- C:\Program Files\InCode Solutions 2008-03-07 00:06 . 2008-03-07 00:48 3,382 --a------ C:\WINDOWS\system32\tmp.reg 2008-03-06 19:18 . 2008-03-08 01:20 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-06 19:18 . 2008-03-06 20:03 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-06 19:18 . 2008-03-06 20:03 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-03-06 19:18 . 2008-03-06 20:03 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-06 03:14 . 2008-03-06 01:15 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-03-06 01:15 . 2008-03-06 03:17 <DIR> d-------- C:\Documents and Settings\sally nguyen\.housecall6.6 2008-03-06 01:12 . 2008-03-06 01:12 <DIR> d-------- C:\Program Files\Google 2008-03-06 01:12 . 2008-03-08 02:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2008-03-06 00:07 . 2008-03-06 00:07 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico 2008-03-05 19:10 . 2008-03-05 19:10 <DIR> d-------- C:\Program Files\Alwil Software 2008-03-04 22:49 . 2008-03-04 22:59 1,302,502 --ahs---- C:\WINDOWS\system32\qqsvndam.ini 2008-03-04 22:38 . 2008-03-04 22:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-03-04 22:07 . 2008-03-12 17:57 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\AVG7 2008-03-04 22:06 . 2008-03-04 22:06 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-03-04 22:05 . 2008-03-05 00:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-03-03 20:55 . 2007-12-06 20:21 6,066,176 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll 2008-03-03 20:55 . 2007-06-30 21:31 2,455,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-03-03 20:55 . 2007-06-30 21:36 991,232 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-03-03 20:55 . 2007-12-06 20:21 459,264 --a------ C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-03-03 20:55 . 2007-12-06 20:21 383,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-03-03 20:55 . 2007-12-06 20:21 267,776 --a------ C:\WINDOWS\system32\dllcache\iertutil.dll 2008-03-03 20:55 . 2007-12-06 20:21 63,488 --a------ C:\WINDOWS\system32\dllcache\icardie.dll 2008-03-03 20:55 . 2007-12-06 20:21 52,224 --a------ C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-03-03 20:55 . 2007-12-06 05:00 13,824 --a------ C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-03-03 20:46 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2008-03-03 19:20 . 2008-03-03 19:20 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\Grisoft 2008-03-03 19:19 . 2008-03-04 23:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-03 19:19 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-03-03 18:15 . 2008-03-03 18:15 <DIR> d-------- C:\Program Files\Lavasoft 2008-03-03 18:15 . 2008-03-03 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-03-03 18:13 . 2008-03-03 18:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-25 11:28 . 2008-03-02 10:59 147 --a------ C:\WINDOWS\BM3647c246.xml 2008-02-25 09:38 . 2008-02-25 09:38 13,942 --a------ C:\WINDOWS\system32\iphone-011.ico 2008-02-25 07:41 . 2008-02-25 11:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Yahoo! 2008-02-25 07:35 . 2008-02-25 07:35 4,286 --a------ C:\WINDOWS\system32\cruise-006.ico 2008-02-25 07:28 . 2008-02-25 07:28 13,942 --a------ C:\WINDOWS\system32\iphone-012.ico 2008-02-24 23:32 . 2008-02-24 23:32 4,286 --a------ C:\WINDOWS\system32\Jamster.ico 2008-02-24 23:28 . 2008-02-24 23:28 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Yahoo! 2008-02-24 23:18 . 2008-02-24 23:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio 2008-02-24 23:17 . 2008-03-03 20:31 <DIR> d--hs---- C:\WINDOWS\c2FsbHkgbmd1eWVu 2008-02-24 23:17 . 2008-02-24 23:17 200,770 --a------ C:\WINDOWS\system32\scnttlwb.exe 2008-02-24 23:16 . 2008-03-06 23:35 <DIR> d-------- C:\WINDOWS\system32\xb8 2008-02-24 23:16 . 2008-03-05 02:50 <DIR> d-------- C:\WINDOWS\system32\to2 2008-02-24 23:16 . 2008-03-03 19:03 <DIR> d-------- C:\WINDOWS\system32\ff3 2008-02-24 23:16 . 2008-03-08 01:21 <DIR> d-------- C:\WINDOWS\system32\cms4 2008-02-24 23:16 . 2008-03-12 18:50 <DIR> d-------- C:\Temp 2008-02-23 20:35 . 2008-02-23 20:35 <DIR> d-------- C:\Program Files\Common Files\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-05 03:00 --------- d-----w C:\Program Files\Yahoo! 2005-08-30 01:07 381,480 ----a-w C:\Program Files\msgr7us.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06D35B80-B281-423C-A6F3-8E123FA0971E}] C:\WINDOWS\system32\fcywu.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{12c9f0ac-c699-4122-8cff-12b58a13092f}] C:\WINDOWS\system32\thpjbccg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A46416F-2E3A-4F49-8001-7674C6FED971}] C:\Program Files\MSN\wykisafem89104.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Tbsa"="C:\WINDOWS\ASKS~1\msiexec.exe" [ ] "Jitcafrl"="C:\Program Files\Common Files\?ssembly\w?crtupd.exe" [ ] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-06 01:12 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-05-03 19:33 32881] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 11:15 98304] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 11:15 536576] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 18:28 49152] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664] "DXDllRegExe"="dxdllreg.exe" [] "HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ] "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 20:55 483328] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 11:32 208958] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-04 23:14 579072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-04 23:03 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-06 01:12:10 125624] Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-29 00:36:18 57344] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggfgdd] hggfgdd.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^Deewoo.lnk] path=C:\Documents and Settings\sally nguyen\Start Menu\Programs\Startup\Deewoo.lnk backup=C:\WINDOWS\pss\Deewoo.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^DW_Start.lnk] path=C:\Documents and Settings\sally nguyen\Start Menu\Programs\Startup\DW_Start.lnk backup=C:\WINDOWS\pss\DW_Start.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\3574f1da] C:\WINDOWS\system32\madnvsqq.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] --a------ 2004-07-30 09:33 286720 C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched] --a------ 2008-02-24 23:17 200770 C:\WINDOWS\system32\scnttlwb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2004-04-21 12:28 286720 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] --a------ 2003-06-18 13:00 200704 c:\Program Files\Microsoft Money\System\mnyexpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2003-05-03 20:55 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecordNow!] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uoltray] --a------ 2004-04-14 12:51 90384 C:\Program Files\NetZero\exec.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] --a------ 2003-08-19 02:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-07-16 15:17 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser] --a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Yahoo! Games\\Bejeweled 2 Deluxe\\WinBej2.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\InCode Solutions\\RemoveIT Pro v4 - SE\\removeit.exe"= S3 ZD1211U(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-08-16 14:50] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c445250-765b-11db-8e97-00c09f4f2830}] \Shell\AutoRun\command - E:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder "2007-12-19 02:36:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job" - c:\Program Files\Easy Internet signup\HPSdpApp.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-12 18:55:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????1?9?1?6??????? ???B???????????????B? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe . ************************************************************************** . Completion time: 2008-03-12 18:58:14 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-13 00:58:11 . 2008-03-07 01:13:21 --- E O F --- Please review and let me know how to proceed. Thanks for all your help!

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\WINDOWS\system32\pavas.ico C:\WINDOWS\system32\Uninstall.ico C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\qqsvndam.ini C:\WINDOWS\BM3647c246.xml C:\WINDOWS\system32\iphone-011.ico C:\WINDOWS\system32\cruise-006.ico C:\WINDOWS\system32\iphone-012.ico C:\WINDOWS\system32\Jamster.ico C:\WINDOWS\system32\scnttlwb.exe C:\WINDOWS\system32\madnvsqq.dll Driver:: hggfgdd 3574f1da Folder:: C:\VundoFix Backups C:\Documents and Settings\All Users\Application Data\Rabio C:\WINDOWS\c2FsbHkgbmd1eWVu C:\WINDOWS\system32\xb8 C:\WINDOWS\system32\to2 C:\WINDOWS\system32\ff3 C:\WINDOWS\system32\cms4 C:\Temp Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06D35B80-B281-423C-A6F3-8E123FA0971E}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{12c9f0ac-c699-4122-8cff-12b58a13092f}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A46416F-2E3A-4F49-8001-7674C6FED971}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Tbsa"=- "Jitcafrl"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggfgdd] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\3574f1da] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Post a new Combofix log.

Here's the new log from Combofix: ComboFix 08-03-10.1 - sally nguyen 2008-03-12 22:41:13.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.185 [GMT -6:00] Running from: C:\Documents and Settings\sally nguyen\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\sally nguyen\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\BM3647c246.xml C:\WINDOWS\system32\cruise-006.ico C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\iphone-011.ico C:\WINDOWS\system32\iphone-012.ico C:\WINDOWS\system32\Jamster.ico C:\WINDOWS\system32\madnvsqq.dll C:\WINDOWS\system32\pavas.ico C:\WINDOWS\system32\qqsvndam.ini C:\WINDOWS\system32\scnttlwb.exe C:\WINDOWS\system32\Uninstall.ico . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Rabio C:\Documents and Settings\sally nguyen\Favorites\.url C:\Temp C:\VundoFix Backups C:\VundoFix Backups\addmorefiles.txt C:\VundoFix Backups\flngvsqj.dllbox.bad C:\WINDOWS\BM3647c246.xml C:\WINDOWS\c2FsbHkgbmd1eWVu C:\WINDOWS\system32\cms4 C:\WINDOWS\system32\cruise-006.ico C:\WINDOWS\system32\ff3 C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\iphone-011.ico C:\WINDOWS\system32\iphone-012.ico C:\WINDOWS\system32\Jamster.ico C:\WINDOWS\system32\pavas.ico C:\WINDOWS\system32\qqsvndam.ini C:\WINDOWS\system32\scnttlwb.exe C:\WINDOWS\system32\to2 C:\WINDOWS\system32\Uninstall.ico C:\WINDOWS\system32\xb8 . ((((((((((((((((((((((((( Files Created from 2008-02-13 to 2008-03-13 ))))))))))))))))))))))))))))))) . 2008-03-08 02:58 . 2008-03-08 02:58 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-07 01:29 . 2008-03-07 01:29 <DIR> d-------- C:\Program Files\InCode Solutions 2008-03-07 00:06 . 2008-03-07 00:48 3,382 --a------ C:\WINDOWS\system32\tmp.reg 2008-03-06 19:18 . 2008-03-08 01:20 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-06 03:14 . 2008-03-06 01:15 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-03-06 01:15 . 2008-03-06 03:17 <DIR> d-------- C:\Documents and Settings\sally nguyen\.housecall6.6 2008-03-06 01:12 . 2008-03-06 01:12 <DIR> d-------- C:\Program Files\Google 2008-03-06 01:12 . 2008-03-08 02:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2008-03-06 00:07 . 2008-03-06 00:07 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico 2008-03-05 19:10 . 2008-03-05 19:10 <DIR> d-------- C:\Program Files\Alwil Software 2008-03-04 22:38 . 2008-03-04 22:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-03-04 22:07 . 2008-03-12 17:57 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\AVG7 2008-03-04 22:06 . 2008-03-04 22:06 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-03-04 22:05 . 2008-03-05 00:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-03-03 20:55 . 2007-12-06 20:21 6,066,176 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll 2008-03-03 20:55 . 2007-06-30 21:31 2,455,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-03-03 20:55 . 2007-06-30 21:36 991,232 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-03-03 20:55 . 2007-12-06 20:21 459,264 --a------ C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-03-03 20:55 . 2007-12-06 20:21 383,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-03-03 20:55 . 2007-12-06 20:21 267,776 --a------ C:\WINDOWS\system32\dllcache\iertutil.dll 2008-03-03 20:55 . 2007-12-06 20:21 63,488 --a------ C:\WINDOWS\system32\dllcache\icardie.dll 2008-03-03 20:55 . 2007-12-06 20:21 52,224 --a------ C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-03-03 20:55 . 2007-12-06 05:00 13,824 --a------ C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-03-03 20:46 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2008-03-03 19:20 . 2008-03-03 19:20 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\Grisoft 2008-03-03 19:19 . 2008-03-04 23:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-03 19:19 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-03-03 18:15 . 2008-03-03 18:15 <DIR> d-------- C:\Program Files\Lavasoft 2008-03-03 18:15 . 2008-03-03 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-03-03 18:13 . 2008-03-03 18:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-25 07:41 . 2008-02-25 11:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Yahoo! 2008-02-24 23:28 . 2008-02-24 23:28 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Yahoo! 2008-02-23 20:35 . 2008-02-23 20:35 <DIR> d-------- C:\Program Files\Common Files\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-05 03:00 --------- d-----w C:\Program Files\Yahoo! 2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2005-08-30 01:07 381,480 ----a-w C:\Program Files\msgr7us.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-06 01:12 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-05-03 19:33 32881] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 11:15 98304] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 11:15 536576] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 18:28 49152] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664] "DXDllRegExe"="dxdllreg.exe" [] "HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ] "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 20:55 483328] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 11:32 208958] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-04 23:14 579072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-04 23:03 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-06 01:12:10 125624] Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-29 00:36:18 57344] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^Deewoo.lnk] path=C:\Documents and Settings\sally nguyen\Start Menu\Programs\Startup\Deewoo.lnk backup=C:\WINDOWS\pss\Deewoo.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^DW_Start.lnk] path=C:\Documents and Settings\sally nguyen\Start Menu\Programs\Startup\DW_Start.lnk backup=C:\WINDOWS\pss\DW_Start.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] --a------ 2004-07-30 09:33 286720 C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2004-04-21 12:28 286720 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] --a------ 2003-06-18 13:00 200704 c:\Program Files\Microsoft Money\System\mnyexpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2003-05-03 20:55 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecordNow!] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uoltray] --a------ 2004-04-14 12:51 90384 C:\Program Files\NetZero\exec.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] --a------ 2003-08-19 02:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-07-16 15:17 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser] --a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Yahoo! Games\\Bejeweled 2 Deluxe\\WinBej2.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\InCode Solutions\\RemoveIT Pro v4 - SE\\removeit.exe"= S3 ZD1211U(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-08-16 14:50] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c445250-765b-11db-8e97-00c09f4f2830}] \Shell\AutoRun\command - E:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder "2007-12-19 02:36:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job" - c:\Program Files\Easy Internet signup\HPSdpApp.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-12 22:43:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????1?9?1?6??????? ???B???????????????B? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-12 22:44:00 ComboFix-quarantined-files.txt 2008-03-13 04:43:42 ComboFix2.txt 2008-03-13 00:58:15 . 2008-03-07 01:13:21 --- E O F --- Thank you!

Much better. Open Notepad and copy/paste everything between the X"s into it and make sure "Registry::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Registry:: [-HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^Deewoo.lnk] [-HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^DW_Start.lnk] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Your java is out of date and can be exploited. Download the latest version of java from this link Java Click on the JDK 6 Update 5 download button. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jdk-6u5-windows-i586-p.exe to install the newest version. I don't install any of the add-ons only java 1.6.0_05 Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download CCleaner from the following link: http://filehippo.com/download_ccleaner/ After you download it to your desktop and begin installing it only allow the "install icon on desktop" to install . Then run it, use only as suggested, it's powerful use only the prechecked items. Run an online scan with Kaspersky from the following link: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply. Post a new Combofix log.

Per your directions- Combofix Log (done before Kapersky scan): ComboFix 08-03-10.1 - sally nguyen 2008-03-13 22:56:10.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.198 [GMT -6:00] Running from: C:\Documents and Settings\sally nguyen\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\sally nguyen\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 ))))))))))))))))))))))))))))))) . 2008-03-08 02:58 . 2008-03-08 02:58 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-07 01:29 . 2008-03-07 01:29 <DIR> d-------- C:\Program Files\InCode Solutions 2008-03-07 00:06 . 2008-03-07 00:48 3,382 --a------ C:\WINDOWS\system32\tmp.reg 2008-03-06 19:18 . 2008-03-08 01:20 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-06 03:14 . 2008-03-06 01:15 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-03-06 01:15 . 2008-03-06 03:17 <DIR> d-------- C:\Documents and Settings\sally nguyen\.housecall6.6 2008-03-06 01:12 . 2008-03-06 01:12 <DIR> d-------- C:\Program Files\Google 2008-03-06 01:12 . 2008-03-08 02:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2008-03-06 00:07 . 2008-03-06 00:07 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico 2008-03-05 19:10 . 2008-03-05 19:10 <DIR> d-------- C:\Program Files\Alwil Software 2008-03-04 22:38 . 2008-03-04 22:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-03-04 22:07 . 2008-03-13 22:46 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\AVG7 2008-03-04 22:06 . 2008-03-04 22:06 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-03-04 22:05 . 2008-03-05 00:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-03-03 20:55 . 2007-12-06 20:21 6,066,176 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll 2008-03-03 20:55 . 2007-06-30 21:31 2,455,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-03-03 20:55 . 2007-06-30 21:36 991,232 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-03-03 20:55 . 2007-12-06 20:21 459,264 --a------ C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-03-03 20:55 . 2007-12-06 20:21 383,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-03-03 20:55 . 2007-12-06 20:21 267,776 --a------ C:\WINDOWS\system32\dllcache\iertutil.dll 2008-03-03 20:55 . 2007-12-06 20:21 63,488 --a------ C:\WINDOWS\system32\dllcache\icardie.dll 2008-03-03 20:55 . 2007-12-06 20:21 52,224 --a------ C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-03-03 20:55 . 2007-12-06 05:00 13,824 --a------ C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-03-03 20:46 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2008-03-03 19:20 . 2008-03-03 19:20 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\Grisoft 2008-03-03 19:19 . 2008-03-04 23:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-03 19:19 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-03-03 18:15 . 2008-03-03 18:15 <DIR> d-------- C:\Program Files\Lavasoft 2008-03-03 18:15 . 2008-03-03 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-03-03 18:13 . 2008-03-03 18:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-25 07:41 . 2008-02-25 11:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Yahoo! 2008-02-24 23:28 . 2008-02-24 23:28 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Yahoo! 2008-02-23 20:35 . 2008-02-23 20:35 <DIR> d-------- C:\Program Files\Common Files\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-05 03:00 --------- d-----w C:\Program Files\Yahoo! 2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2005-08-30 01:07 381,480 ----a-w C:\Program Files\msgr7us.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-06 01:12 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-05-03 19:33 32881] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 11:15 98304] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 11:15 536576] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 18:28 49152] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664] "DXDllRegExe"="dxdllreg.exe" [] "HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ] "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 20:55 483328] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 11:32 208958] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-04 23:14 579072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-04 23:03 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-06 01:12:10 125624] Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-29 00:36:18 57344] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] --a------ 2004-07-30 09:33 286720 C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2004-04-21 12:28 286720 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] --a------ 2003-06-18 13:00 200704 c:\Program Files\Microsoft Money\System\mnyexpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2003-05-03 20:55 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecordNow!] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uoltray] --a------ 2004-04-14 12:51 90384 C:\Program Files\NetZero\exec.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] --a------ 2003-08-19 02:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-07-16 15:17 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser] --a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Yahoo! Games\\Bejeweled 2 Deluxe\\WinBej2.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\InCode Solutions\\RemoveIT Pro v4 - SE\\removeit.exe"= S3 ZD1211U(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-08-16 14:50] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c445250-765b-11db-8e97-00c09f4f2830}] \Shell\AutoRun\command - E:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder "2007-12-19 02:36:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job" - c:\Program Files\Easy Internet signup\HPSdpApp.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-13 22:58:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????1?9?1?6??????? ???B???????????????B? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-13 22:59:02 ComboFix-quarantined-files.txt 2008-03-14 04:58:53 ComboFix2.txt 2008-03-13 04:44:01 ComboFix3.txt 2008-03-13 00:58:15 . 2008-03-13 06:12:45 --- E O F --- Kapersky Logfile: --------------------- KASPERSKY ONLINE SCANNER REPORT Friday, March 14, 2008 1:20:28 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 13/03/2008 Kaspersky Anti-Virus database records: 626915 --------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 48929 Number of viruses found: 3 Number of infected objects: 6 Number of suspicious objects: 0 Duration of the scan process: 01:15:22 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\muvee Technologies\030410\0102\0102\values Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\sally nguyen\.housecall6.6\Quarantine\wykisafem89104.dll.bac_a01288 Infected: not-a-virus:AdWare.Win32.TTC.d skipped C:\Documents and Settings\sally nguyen\Cookies\index.dat Object is locked skipped C:\Documents and Settings\sally nguyen\Desktop\Security\DON'T MESS WITH THESE!!!\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\sally nguyen\Desktop\Security\DON'T MESS WITH THESE!!!\SmitfraudFix\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\sally nguyen\Desktop\Security\DON'T MESS WITH THESE!!!\SmitfraudFix\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\sally nguyen\Desktop\Security\DON'T MESS WITH THESE!!!\SmitfraudFix\SmitfraudFix.exe RarSFX: infected - 2 skipped C:\Documents and Settings\sally nguyen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\sally nguyen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\sally nguyen\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\sally nguyen\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\sally nguyen\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\sally nguyen\NTUSER.DAT Object is locked skipped C:\Documents and Settings\sally nguyen\ntuser.dat.LOG Object is locked skipped C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\scnttlwb.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.aj skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP6\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{57D49D39-ABF2-4FDE-A658-35F0D2EDC090}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Thank you for all your help!!