Hello Apologies in advance if I was supposed to use an existing post for this. I have read the other posts with regard to this virus (F- secure was finding on my PC) and have added the log from Malware Bytes below any advice? Thank in advance.: Malwarebytes' Anti-Malware 1.31 Database version: 1456 Windows 5.1.2600 Service Pack 3 12/3/2008 9:15:10 PM mbam-log-2008-12-03 (21-15-10).txt Scan type: Quick Scan Objects scanned: 59783 Time elapsed: 7 minute(s), 26 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 16 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\TDSSIRXY.0LL (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSNCUR.0LL (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSOIPA.0LL (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSYAVU.0LL (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\TDSSmxoe.0ys (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSSabe7.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\hosts (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wertyu.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\getwn32.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\av.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\HP_Owner\Local Settings\Temp\TDSS457c.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSSaaaf.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\HP_Owner\Local Settings\Temp\TDSSf2b9.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\HP_Owner\Local Settings\Temp\TDSSf3c2.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSqxnr.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

As we cannot tell what Antivirus or Antispyware you have please turn it all off before running SDFix. Download SDFix.exe and save it to your Desktop. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. Remember to re-enable the protection again afterwards before connecting to the Internet. 1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. 2. Open the c:\SDFix folder and double click RunThis.cmd to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. 3. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. 4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Hello Here are the logs: [b]SDFix: Version 1.240 [/b] Run by HP_Owner on Thu 12/04/2008 at 06:22 AM Microsoft Windows XP [Version 5.1.2600] Running From: C:\sdfix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\SYSTEM32\AV.exe - Deleted C:\WINDOWS\system32\av.exe - Deleted C:\WINDOWS\SYSTEM32\TDSSMUPE.dat - Deleted Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:54:17 PM, on 12/4/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Shaw Secure\Anti- Virus\fsgk32st.exe C:\Program Files\Shaw Secure\Common\FSMA32.exe C:\Program Files\Shaw Secure\Anti- Virus\FSGK32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Shaw Secure\Common\FSMB32.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\Program Files\Shaw Secure\Common\FCH32.exe C:\WINDOWS\Explorer.exe C:\Program Files\Shaw Secure\Common\FAMEH32.exe C:\Program Files\Shaw Secure\Anti- Virus\fsqh.exe C:\Program Files\Shaw Secure\FSPC\fspc.exe C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe C:\Program Files\Shaw Secure\Anti- Virus\fssm32.exe C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Shaw Secure\FSAUA\program\fsus.exe C:\Program Files\Shaw Secure\Anti- Virus\fsav32.exe C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\notepad.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hphmon06.exe C:\WINDOWS\system32\ps2.exe C:\Program Files\Scansoft\PaperPort\pptd40nt.exe C:\Program Files\Shaw Secure\Common\FSM32.exe C:\Program Files\Shaw Secure\FSGUI\ispnews.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zune\ZuneLauncher.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Shaw Secure\FSGUI\fsguidll.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\rundll32.exe C:\Documents and Settings\HP_Owner\My Documents\Downloads\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr? TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pav ilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Windows\CurrentVersio n\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - {02478D38-C3F9-4efb- 9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD- 4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim. dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4- A3CB-D426709BBFEB} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0- 462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC- A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: CPrintEnhancer Object - {AE84A6AA- A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB- 8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hp ztsb10.exe O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm .exe -startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Shaw Secure\Common\FSM32.exe" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Shaw Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [News Service] "C:\Program Files\Shaw Secure\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarIni t O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" - atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.exe /3000 O9 - Extra button: (no name) - {08B0E5C0- 4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Parental... - {200DB664- 75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Shaw Secure\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664- 75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Shaw Secure\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Shaw Secure\FSPC\fspcmsie.dll O9 - Extra button: Skype - {77BF5300-1474- 4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38- d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,- 20001 - {e2e2dd38-d088-4134-82b7- f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910- F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E- 00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {04E214E5-63AF-4236-83C6- A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/h... scan60.cab O16 - DPF: {0CCA191D-13A6-4E29-B746- 314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls... hotoUploader5.cab O16 - DPF: {17492023-C23A-453E-A040- C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {238F6F83-B8B4-11CF-8771- 00A024541EE3} (Citrix ICA Client) - http://www.runaware.com/dolphin/wfi... O16 - DPF: {30528230-99f7-4bb4-88d8- fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {39B0684F-D7BF-4743-B050- FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/c... .1.1.74.cab O16 - DPF: {3BFFE033-BF43-11D5-A271- 00A024A51325} (iNotes6 Class) - http://webmail.ewos.ca/iNotes6W.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532- 2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.c... es/MsnPUpld.cab O16 - DPF: {56393399-041A-4650-94C7- 13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/... ab O16 - DPF: {62789780-B744-11D0-986B- 00609731A21D} (Autodesk MapGuide ActiveX Control) - http://citymap.nanaimo.ca/mgaxctrl.cab O16 - DPF: {6E32070A-766D-4EE6-879C- DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... 6/V5Controls/en/x86/client/muweb_site.cab? 1146109312765 O16 - DPF: {6E5A37BF-FD42-463A-877C- 4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/h... pplet/html/native/x86/win32/activex/hcImpl.ca b O16 - DPF: {74D05D43-3236-11D4-BDCD- 00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/... /housecall.trendmicro.com/housecall/xscan53.c ab O16 - DPF: {7584C670-2274-4EFB-B00B- D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://24.87.64.67/Remote/msrdp.cab O16 - DPF: {90C9629E-CD32-11D3-BBFB- 00105A1F0D68} (InstallShield International Setup Player) - http://www.lowrance.com/Downloads/E... nstall/iFINDERH2O/isetup.cab O16 - DPF: {A18962F6-E6ED-40B1-97C9- 1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://photolab.ca/en/Photo/ImageUp... b O16 - DPF: {AB86CE53-AC9F-449F-9399- D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf- JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {ABAB45AD-4D69-4C01-A4A4- DD105F1EAE61} (mgToolbarPub.Toolbar) - http://citymap.nanaimo.ca/activeX/T... b O16 - DPF: {B38870E4-7ECB-40DA-8C6A- 595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M... rSetupDownloader.cab O16 - DPF: {E991BDE0-9816-4094-853E- 6BDB60F0342D} (Get_ActiveX Control) - http://apps.corel.com/nos_dl_manage... ENetOpPlugin.ocx O18 - Protocol: CDS300 - {AD43AA67-6860-4531- AC8A-0E68F9CF023E} - E:\CDS300\__CDS2.dll (file missing) O18 - Protocol: intu-qt2007 - {026BF40D-BA05- 467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll O18 - Protocol: skype4com - {FFC8B962-9B40- 4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Shaw Secure\Anti- Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Shaw Secure\Common\FSMA32.exe O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308- 165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O24 - Desktop Component 0: (no name) - http://music.shaw.ca/player/images/... -- End of file - 12876 bytes

Your java is out of date and may have been exploited. Download the latest version of java from this link Java Click on the JRE 6 Update 11 download button. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version. Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your Shaw Secure antivirus, and any antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

Hello Here's the ComboFix log. I turned off the virus protection but left shaw secure going hopefully that's enough. ComboFix 08-12-02.02 - HP_Owner 2008-12-04 20:15:24.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.498 [GMT -8:00] Running from: c:\documents and settings\HP_Owner\My Documents\Downloads\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))) )))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\windows\Downloaded Program Files\Quarantine c:\windows\system32\mdm.exe c:\windows\system32\packet.dll c:\windows\system32\wanpacket.dll c:\windows\system32\wpcap.dll D:\Autorun.inf ----- BITS: Possible infected sites ----- hxxp://i380.photobucket.com . ((((((((((((((((((((((((( Files Created from 2008-11-05 to 2008-12-05 ))))))))))))))))))))))))))))))) . 2008-12-04 20:07 . 2008-12-04 20:07 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-04 20:07 . 2008-12-04 20:07 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-12-04 06:21 . 2008-12-04 06:21 578,560 --a------ c:\windows\system32\dllcache\user32.dll 2008-12-04 06:17 . 2008-12-04 06:17 <DIR> d-------- c:\windows\ERUNT 2008-12-04 05:43 . 2008-12-04 08:16 <DIR> d-------- C:\SDFix 2008-12-03 21:05 . 2008-12-03 21:05 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-12-03 21:05 . 2008-12-03 21:05 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Malwarebytes 2008-12-03 21:05 . 2008-12-03 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-12-03 21:05 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-03 21:05 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-12-01 16:49 . 2008-12-01 16:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-01 16:46 . 2008-12-01 16:47 <DIR> d-------- c:\program files\QuickTime 2008-11-29 23:43 . 2008-11-29 23:43 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Memeo 2008-11-29 23:37 . 2008-11-29 23:37 <DIR> d-------- c:\program files\Memeo 2008-11-29 23:37 . 2008-11-29 23:37 <DIR> d-------- c:\program files\Common Files\eSellerate 2008-11-28 21:38 . 2008-11-28 21:38 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Yahoo! 2008-11-28 20:20 . 2008-11-28 20:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant 2008-11-26 20:00 . 2008-11-26 20:00 <DIR> d-------- c:\program files\Common Files\Adobe AIR 2008-11-16 21:14 . 2008-11-16 21:14 259,448 --a------ c:\windows\system32\awrdscdc.ax 2008-11-16 21:13 . 2008-11-16 21:14 <DIR> d-------- c:\program files\Audible 2008-11-16 18:22 . 2008-11-16 18:22 0 --ah----- c:\windows\system32\drivers\Msft_User_ZuneDri ver_01_07_00.Wdf 2008-11-16 18:22 . 2008-11-16 18:22 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_WinUS B_01007.Wdf 2008-11-16 18:20 . 2008-11-16 18:20 0 --ah----- c:\windows\system32\drivers\MsftWdf_user_01_0 7_00.Wdf 2008-11-16 17:51 . 2008-03-21 13:57 14,640 --------- c:\windows\system32\spmsgXP_2k3.dll 2008-11-16 17:51 . 2008-11-16 17:51 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01 007_Coinstaller_Critical.Wdf 2008-11-16 17:51 . 2008-11-16 17:51 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_zumbu s_01007.Wdf 2008-11-16 17:50 . 2008-11-23 19:27 <DIR> d-------- c:\program files\Zune 2008-11-16 17:47 . 2008-05-02 05:25 465,920 --------- c:\windows\system32\imapi2fs.dll 2008-11-16 17:47 . 2008-05-02 05:25 465,920 --------- c:\windows\system32\dllcache\imapi2fs.dll 2008-11-16 17:47 . 2008-05-02 05:25 317,952 --------- c:\windows\system32\imapi2.dll 2008-11-16 17:47 . 2008-05-02 05:25 317,952 --------- c:\windows\system32\dllcache\imapi2.dll 2008-11-16 17:47 . 2008-05-02 02:49 62,976 --------- c:\windows\system32\dllcache\cdrom.sys 2008-11-15 21:30 . 2008-11-15 21:30 <DIR> d-------- c:\program files\Bonjour 2008-11-12 17:24 . 2008-09-04 09:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll 2008-11-12 17:24 . 2008-10-24 03:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-10 12:23 . 2008-11-10 12:23 243,840 --a------ c:\windows\system32\ZuneWlanCfgSvc.exe 2008-11-10 12:23 . 2008-11-10 12:23 60,032 --a------ c:\windows\system32\ZuneBusEnum.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))) ))))))) . 2008-12-05 04:07 --------- d---- -w c:\program files\Java 2008-12-05 04:04 --------- d---- -w c:\documents and settings\HP_Owner\Application Data\Skype 2008-12-05 04:03 --------- d---- -w c:\program files\RegScrubXP 2008-12-05 04:00 --------- d---- -w c:\documents and settings\HP_Owner\Application Data\skypePM 2008-12-04 01:24 --------- d---- -w c:\program files\WinAce 2008-12-03 14:25 --------- d---- -w c:\program files\Quicken 2008-12-03 14:23 --------- d---- -w c:\program files\Yahoo! 2008-12-03 14:04 --------- d---- -w c:\program files\Common Files\Adobe 2008-12-02 00:50 --------- d---- -w c:\program files\iTunes 2008-12-02 00:49 --------- d---- -w c:\program files\iPod 2008-12-02 00:49 --------- d---- -w c:\program files\Common Files\Apple 2008-11-29 05:16 --------- d---- -w c:\program files\DivX 2008-11-27 13:31 --------- d---- -w c:\program files\NOS 2008-11-27 13:31 --------- d---- -w c:\documents and settings\All Users\Application Data\NOS 2008-11-16 06:58 --------- d---- -w c:\program files\Apple Software Update 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 23:45 --------- d---- -w c:\program files\Shaw Secure 2008-10-13 18:50 --------- d---- -w c:\documents and settings\HP_Owner\Application Data\U3 2008-09-14 16:16 466,944 ----a-w c:\windows\Welcome to Sooke BC.scr 2008-09-14 16:16 180,224 ----a-w c:\windows\UninstallWSST.exe 2007-01-26 13:30 81,920 ----a-w c:\documents and settings\HP_Owner\Application Data\ezpinst.exe 2007-01-26 13:30 47,360 ----a-w c:\documents and settings\HP_Owner\Application Data\pcouffin.sys 2006-04-29 14:01 56 --sh--r c:\windows\system32\53FCA3238C.sys 2006-04-29 14:01 3,350 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))) ))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows \CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-06-03 21718312] "Google Update"="c:\documents and settings\HP_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008- 11-28 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window s\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456] "Recguard"="c:\windows\SMINST\RECGUARD.exe" [2004-04-14 233472] "PS2"="c:\windows\system32\ps2.exe" [2002-10- 16 81920] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w 32x86\3\hpztsb10.exe" [2004-03-23 172032] "PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2001- 09-10 45108] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDAT E~1\isuspm.exe" [2005-02-16 221184] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-09 7561216] "F-Secure Manager"="c:\program files\Shaw Secure\Common\FSM32.exe" [2007-04-26 176177] "F-Secure TNB"="c:\program files\Shaw Secure\FSGUI\TNBUtil.exe" [2007-04-26 733184] "News Service"="c:\program files\Shaw Secure\FSGUI\ispnews.exe" [2005-05-31 356352] "NvMediaCenter"="c:\windows\system32\NvMcTray .dll" [2006-03-09 86016] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10- 01 111936] "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-28 30192] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600] "nwiz"="nwiz.exe" [2006-03-09 c:\windows\system32\nwiz.exe] "SiSPower"="SiSPower.dll" [2004-09-24 c:\windows\system32\SiSPower.dll] [HKEY_LOCAL_MACHINE\software\microsoft\window s nt\currentversion\drivers32] "VIDC.ACDV"= ACDV.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06] --a------ 2004-06-07 10:53 49152 c:\program files\HP\{AAC4FC36-8F89-4587-8DD3- EBC57C83374D}\hphupd06.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch] --a------ 2001-09-10 06:44 36864 c:\program files\Scansoft\PaperPort\IndexSearch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2005-02-16 17:15 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM .exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2005-06-10 08:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Memeo Share] --a------ 2008-11-10 12:37 144656 c:\program files\Memeo\Memeo Share\MemeoLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 16:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] --a------ 2007-01-19 11:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rainlendar2] --a------ 2006-11-26 08:28 984064 c:\program files\Rainlendar2\Rainlendar2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2004-12-01 21:39 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG] --a------ 2004-06-29 09:06 88363 c:\windows\AGRSMMSG.exe [HKLM\~\services\sharedaccess\parameters\fire wallpolicy\standardprofile\AuthorizedApplicat ions\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\He lpCtr.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\utorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program Files\\NetMeeting\\conf.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2006-01-09 51072] R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328] R1 bbcap;bbcap;c:\windows\system32\DRIVERS\bbcap .sys [2007-05-13 2944] R1 F-Secure HIPS;F-Secure HIPS;\??\c:\program files\Shaw Secure\HIPS\fshs.sys [2007-07-19 41184] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\? ?\c:\program files\Shaw Secure\Anti- Virus\minifilter\fsgk.sys [2006-04-18 52736] S3 atirage;atirage;c:\windows\system32\DRIVERS\a tiragem.sys [2006-03-27 70528] S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-28 30192] S4 F-Secure Filter;F-Secure File System Filter;\??\c:\program files\Shaw Secure\Anti- Virus\Win2K\FSfilter.sys [2006-01-09 33024] S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\c:\program files\Shaw Secure\Anti-Virus\Win2K\FSrec.sys [2006-01-09 18432] [HKEY_LOCAL_MACHINE\software\microsoft\window s nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows \currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 [HKEY_CURRENT_USER\software\microsoft\windows \currentversion\explorer\mountpoints2\{946850 c5-1e27-11d9-baf0-806d6172696f}] \Shell\AutoRun\command - D:\setup.exe . Contents of the 'Scheduled Tasks' folder 2008-12-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2008-12-05 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\HP_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11- 28 20:26] . - - - - ORPHANS REMOVED - - - - HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe MSConfigStartUp-AVG7_CC - c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe MSConfigStartUp-DAEMON Tools Pro Agent - c:\program files\DAEMON Tools Pro\DTProAgent.exe MSConfigStartUp-Device Detector - c:\program files\Common Files\ACD Systems\EN\DevDetect.exe MSConfigStartUp-nmapp - c:\program files\Pure Networks\Network Magic\nmapp.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\j2re1.4.2_03\bin\jusched.exe . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\ddyvvjwz.defaul t\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF- 8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.valleylinks.net/ . ********************************************* ***************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-04 20:20:47 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************* ***************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(640) c:\program files\Shaw Secure\FSPS\program\fslsp.dll . r Running Proce . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Shaw Secure\Anti- Virus\fsgk32st.exe c:\program files\Shaw Secure\Common\FSMA32.exe c:\program files\Shaw Secure\Anti- Virus\fsgk32.exe c:\program files\Shaw Secure\Common\FSMB32.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\ZuneBusEnum.exe c:\program files\Shaw Secure\Common\FCH32.exe c:\program files\Shaw Secure\Common\FAMEH32.exe c:\program files\Shaw Secure\Anti- Virus\fsqh.exe c:\program files\Shaw Secure\FSPC\fspc.exe c:\program files\Shaw Secure\FSAUA\program\fsaua.exe c:\program files\Shaw Secure\Anti- Virus\fssm32.exe c:\program files\Shaw Secure\FWES\program\fsdfwd.exe c:\program files\Shaw Secure\FSAUA\program\fsus.exe c:\progra~1\SHAWSE~1\ANTI-V~1\fsav32.exe c:\windows\system32\wscntfy.exe c:\progra~1\SHAWSE~1\Common\FSM32.exe c:\progra~1\SHAWSE~1\FSGUI\fsguidll.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Skype\Plugin Manager\skypePM.exe . ********************************************* ***************************** . Completion time: 2008-12-04 20:25:55 - machine was rebooted [HP_Owner] ComboFix-quarantined-files.txt 2008-12-05 04:25:52 Pre-Run: 69,093,048,320 bytes free Post-Run: 69,026,516,992 bytes free 250 --- E O F --- 2008-11-13 06:40:38

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: http://www.majorgeeks.com/ATF_Cleaner_d4949.html Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Please run Esets online scanner from this link: ESET 1. Note: You will need to use Internet explorer for this scan 2. Tick the box next to YES, I accept the Terms of Use. 3. Click Start 4. When asked, allow the activex control to install 5. Click Start 6. Make sure that the option Remove found threats is unticked ( I want to see what is found first), and the option Scan unwanted applications is checked 7. Click Scan 8. Wait for the scan to finish 9. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt 10. Copy and paste that log in your next reply.

Here is the eset log: # version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3665 (20081204) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.064 (20070717) # EOSSerial=9fbee37ad4d70246a429c872b1066f55 # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2008-12-05 06:58:40 # local_time=2008-12-04 10:58:40 (-0800, Pacific Standard Time) # country="United States" # osver=5.1.2600 NT Service Pack 3 # scanned=537455 # found=13 # scan_time=5624 C:\Documents and Settings\HP_Owner\My Documents\My Music\!!!!! joel plaskett 12.wma WMA/TrojanDownloader.Wimad.D trojan 687EA9132025EC1313410EAC33AD6CBA C:\Documents and Settings\HP_Owner\My Documents\My Music\!!!!! the freewheelin bob dylan !!!!! (Rock).wma WMA/TrojanDownloader.Wimad.D trojan 30E2E7B1AEBB60EC7265BE70160B850F C:\Documents and Settings\HP_Owner\My Documents\My Music\!!!!! the freewheelin bob dylan !!!!! XviD.wma WMA/TrojanDownloader.Wimad.D trojan 7B6BD8A92AB5CAE1F62245DD825F6F87 C:\Documents and Settings\HP_Owner\My Documents\My Music\(Serial) several stringbands 42.wma WMA/TrojanDownloader.Wimad.D trojan D5234AAF993CF63F252408684A72BD70 C:\Documents and Settings\HP_Owner\My Documents\My Music\(working) the freewheelin bob dylan by CLASS [Theme].wma WMA/TrojanDownloader.Wimad.D trojan C31D08D8C3506C1A8FDA4CCD9DDFDB72 C:\Documents and Settings\HP_Owner\My Documents\My Music\02 Track 2.wma WMA/TrojanDownloader.Wimad.K trojan E5237D44DE618BD0F7BD067F83271486 C:\Documents and Settings\HP_Owner\My Documents\My Music\06 Track 6.wma WMA/TrojanDownloader.Wimad.K trojan CAFC030C42DB840D326C75D40F724947 C:\Documents and Settings\HP_Owner\My Documents\My Music\07 Track 7 (pornographers).wma WMA/TrojanDownloader.Wimad.K trojan 7E49EAE4BE8CEF78017B13117ACD31C4 C:\Documents and Settings\HP_Owner\My Documents\My Music\Eighties classic.wma WMA/TrojanDownloader.Wimad.K trojan F8DEADE293428758C2AFFA4F802274DB C:\Documents and Settings\HP_Owner\My Documents\My Music\Rare Recording.wma WMA/TrojanDownloader.Wimad.K trojan 8421B5FE465A2BAA55A201F5E89D7715 C:\Documents and Settings\HP_Owner\My Documents\My Music\Top of Charts - 2004.wma WMA/TrojanDownloader.Wimad.K trojan C99DAFC164802A4C0E4DBA3A8FA7872E C:\Documents and Settings\HP_Owner\My Documents\My Music\www.freewarez.to frog eyes 56.wma WMA/TrojanDownloader.Wimad.D trojan 1747AC2EAB8AC509C17472C4BE1B7B18 C:\Documents and Settings\HP_Owner\Shared\Eighties classic.wma WMA/TrojanDownloader.Wimad.D trojan 3A4F253490D04DD94CD1E9B8AB7CC301