I have done scans with my AVG and the following continue to come up, even after I have removed them, shut the computer down and not used it: Trojan horse Generic11.AIJY Trojan horse Generic11.AIHW Trojan horse Generic11.AHXB Trojan horse Generic11.AHIB Trojan horse Generic11.AIJV What can I do? Should I do a windows repair or a windows re-install? Thanks

Please download Malwarebytes' Anti-Malware from one of these sites: MalwareBytes1 MalwareBytes2 1. Double Click mbam-setup.exe to install the application. 2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. 3. If an update is found, it will download and install the latest version. 4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. 5. When the scan is complete, click OK, then Show Results to view the results. 6. Make sure that everything found is checked, and click Remove Selected. 7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. 8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. 9. Copy&Paste the entire report in your next reply. Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Here is the result of the first part of the instructions: Malwarebytes' Anti-Malware 1.28 Database version: 1215 Windows 5.1.2600 Service Pack 2 9/27/2008 2:22:37 PM mbam-log-2008-09-27 (14-22-37).txt Scan type: Quick Scan Objects scanned: 37252 Time elapsed: 2 minute(s), 21 second(s) Memory Processes Infected: 0 Memory Modules Infected: 2 Registry Keys Infected: 13 Registry Values Infected: 1 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 17 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\urqRHwuu.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\cbdsks.dll (Trojan.Vundo) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{13476fc4-208a-4647-9d9d-ca7ff0282b0c} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{13476fc4-208a-4647-9d9d-ca7ff0282b0c} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7028d80b-b87e-4ed7-978b-4a5b977c543f} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7028d80b-b87e-4ed7-978b-4a5b977c543f} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm4be3eaaa (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrhwuu -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrhwuu -> Delete on reboot. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\urqRHwuu.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\uuwHRqru.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\uuwHRqru.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\cbdsks.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\kfhpiuyw.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wyuiphfk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vnspiuck.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ubjcgcwu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\kiglccye.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\abxilxlf.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ynaepz.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\oobrqpji.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\BM4be3eaaa.xml (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\BM4be3eaaa.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

Here is the logfile from the second part of the instructions (hijackthis): Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:31:37 PM, on 9/27/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe F:\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe F:\SYSTEM~2\WScheduler.exe C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe f:\AVG8\avgwdsvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe F:\Hotspot\hotspot.exe C:\WINDOWS\System32\nvsvc32.exe C:\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\wdfmgr.exe C:\OpenOffice.org 2.4\program\soffice.BIN f:\AVG8\avgrsx.exe f:\AVG8\avgemc.exe F:\Mozilla Firefox\firefox.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\WINDOWS\system32\NOTEPAD.exe E:\Downloads\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {0254FA57-D61C-4ECE-A0F9-EE31CCFA6C9D} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {1F5FDA83-4379-4C6A-94AD-CC7BC688505A} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {89324012-43FB-4271-9390-3816FC37C72C} - (no file) O2 - BHO: (no name) - {C2B6C3A9-3612-4509-BB9A-DABB311877C2} - (no file) O2 - BHO: (no name) - {CBDC711D-B71F-4C39-B8E4-2F6C614F2E9B} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AVG8_TRAY] f:\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WScheduler] f:\SYSTEM~2\WScheduler.exe /LOGON O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe O4 - HKCU\..\Run: [IE Privacy Keeper] "f:\IE Privacy Keeper\IEPrivacyKeeper.exe" -startup O4 - Startup: hotspot.lnk = F:\Hotspot\hotspot.exe O4 - Startup: OpenOffice.org 2.4.lnk = C:\OpenOffice.org 2.4\program\quickstart.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows... O17 - HKLM\System\CCS\Services\Tcpip\..\{6BA9BD7B-1B0A-41D2-8074-AF8AC7D18DB7}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - f:\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll cbdsks.dll O20 - Winlogon Notify: byXnOigF - byXnOigF.dll (file missing) O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - f:\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - f:\AVG8\avgwdsvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 4760 bytes

I did a full system scan and this is what I got: Malwarebytes' Anti-Malware 1.28 Database version: 1215 Windows 5.1.2600 Service Pack 2 9/27/2008 3:02:12 PM mbam-log-2008-09-27 (15-02-12).txt Scan type: Full Scan (C:\|D:\|E:\|F:\|) Objects scanned: 66108 Time elapsed: 19 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 12 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP31\A0009073.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP32\A0009171.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP33\A0009218.DLL (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP34\A0009281.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP36\A0010288.DLL (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP36\A0010290.DLL (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP36\A0010291.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP36\A0010292.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP36\A0010293.DLL (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP36\A0010294.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP36\A0010295.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{5FBAF8A7-0D74-4C2D-A556-22BD4A36498E}\RP36\A0010305.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Run Hijack This, cloase all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - {0254FA57-D61C-4ECE-A0F9-EE31CCFA6C9D} - (no file) O2 - BHO: (no name) - {1F5FDA83-4379-4C6A-94AD-CC7BC688505A} - (no file) O2 - BHO: (no name) - {89324012-43FB-4271-9390-3816FC37C72C} - (no file) O2 - BHO: (no name) - {C2B6C3A9-3612-4509- BB9A-DABB311877C2} - (no file) O2 - BHO: (no name) - {CBDC711D-B71F-4C39-B8E4-2F6C614F2E9B} - (no file) O20 - Winlogon Notify: byXnOigF - byXnOigF.dll (file missing) Exit Hijack This. Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your AVG antivirus, and any antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

Here is the log from combofix: ComboFix 08-09-27.01 - Connie 2008-09-29 14:44:12.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.445 [GMT -7:00] Running from: E:\Downloads\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-08-28 to 2008-09-29 ))))))))))))))))))))))))))))))) . 2008-09-27 16:09 . 2008-09-27 16:10 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\DivX 2008-09-27 16:07 . 2008-09-27 16:07 <DIR> d-------- C:\Program Files\DivX 2008-09-27 14:15 . 2008-09-27 14:15 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-27 14:15 . 2008-09-27 14:15 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\Malwarebytes 2008-09-27 14:15 . 2008-09-27 14:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-27 14:15 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-27 14:15 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-27 08:59 . 2008-09-27 08:59 0 --a------ C:\WINDOWS\Irremote.ini 2008-09-26 22:54 . 2008-09-26 22:55 974,956 ---hs---- C:\WINDOWS\system32\ihmbqlfb.ini 2008-09-26 15:07 . 2008-09-26 15:08 974,956 ---hs---- C:\WINDOWS\system32\cjthuoou.ini 2008-09-25 15:02 . 2008-09-26 22:40 656,475 --ahs---- C:\WINDOWS\system32\YbHhQXbc.ini2 2008-09-25 15:02 . 2008-09-26 22:42 656,475 --ahs---- C:\WINDOWS\system32\YbHhQXbc.ini 2008-09-24 17:38 . 2008-09-25 14:57 1,109,964 ---hs---- C:\WINDOWS\system32\yrcagetb.ini 2008-09-24 17:32 . 2008-09-25 14:53 602,388 --ahs---- C:\WINDOWS\system32\CLlTttwa.ini2 2008-09-24 17:32 . 2008-09-25 14:54 602,388 --ahs---- C:\WINDOWS\system32\CLlTttwa.ini 2008-09-24 02:18 . 2008-09-24 17:27 1,089,127 ---hs---- C:\WINDOWS\system32\fixejtvm.ini 2008-09-23 19:41 . 2008-09-23 19:41 <DIR> d-------- C:\WINDOWS\Sun 2008-09-23 02:17 . 2008-09-24 02:18 1,089,268 ---hs---- C:\WINDOWS\system32\jcxsoylt.ini 2008-09-22 02:11 . 2008-09-23 02:13 1,048,101 ---hs---- C:\WINDOWS\system32\goduvyfq.ini 2008-09-22 02:08 . 2008-09-24 17:23 611,844 --ahs---- C:\WINDOWS\system32\prYGNXbc.ini2 2008-09-22 02:08 . 2008-09-24 17:25 611,844 --ahs---- C:\WINDOWS\system32\prYGNXbc.ini 2008-09-21 22:00 . 2008-09-21 22:00 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\CyberLink 2008-09-21 22:00 . 2008-09-21 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink 2008-09-21 21:50 . 2008-09-21 21:50 <DIR> d-------- C:\Program Files\NeroInstall.bak 2008-09-21 21:49 . 2008-09-21 21:49 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\Nero 2008-09-21 21:41 . 2008-09-21 21:41 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-09-21 21:41 . 2008-09-21 21:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-09-20 11:49 . 2008-09-22 02:03 989,547 ---hs---- C:\WINDOWS\system32\adlbljye.ini 2008-09-20 11:48 . 2008-09-20 11:48 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-09-20 11:45 . 2008-09-21 09:22 610,772 --ahs---- C:\WINDOWS\system32\aJRCLnmp.ini2 2008-09-20 11:45 . 2008-09-20 11:57 1,617 --ahs---- C:\WINDOWS\system32\aJRCLnmp.ini 2008-09-20 11:41 . 2008-09-20 11:41 32 --a------ C:\WINDOWS\MS Office 2007 Pro Plus & Expression Web.INI 2008-09-20 00:24 . 2008-09-20 00:24 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\Ahead 2008-09-20 00:24 . 2008-09-20 00:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LightScribe 2008-09-19 18:07 . 2008-09-19 18:07 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\Azureus 2008-09-19 18:07 . 2008-09-19 18:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-09-18 22:48 . 2008-09-18 22:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-09-18 20:11 . 2008-09-18 20:11 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\U3 2008-09-18 20:04 . 2008-09-18 20:04 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\OpenOffice.org2 2008-09-18 20:01 . 2008-09-18 20:01 <DIR> d--h----- C:\Program Files\Zenographics 2008-09-18 20:01 . 2008-09-18 20:01 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-09-18 20:01 . 2006-01-30 09:00 442,368 -ra------ C:\WINDOWS\system32\zshp1018.exe 2008-09-18 20:01 . 2006-01-30 09:00 143,360 -ra------ C:\WINDOWS\apptune1018.exe 2008-09-18 20:01 . 2006-01-30 09:00 129,092 -ra------ C:\WINDOWS\system32\hp1018.img 2008-09-18 20:01 . 2006-01-30 09:00 106,496 -ra------ C:\WINDOWS\system32\vshp1018.dll 2008-09-18 20:01 . 2006-01-30 09:00 102,400 -ra------ C:\WINDOWS\system32\zlhp1018.dll 2008-09-18 20:01 . 2006-01-30 09:00 86,016 -ra------ C:\WINDOWS\system32\ZSPOOL.DLL 2008-09-18 20:01 . 2006-01-30 09:00 28,672 -ra------ C:\WINDOWS\system32\zlm.dll 2008-09-18 20:01 . 2006-01-30 09:00 28,672 -ra------ C:\WINDOWS\system32\IMF32.DLL 2008-09-18 20:01 . 2006-01-30 09:00 24,576 -ra------ C:\WINDOWS\system32\ZTAG32.DLL 2008-09-18 20:01 . 2006-01-30 09:00 7,280 -ra------ C:\WINDOWS\system32\ZSHP1018.HLP 2008-09-18 19:56 . 2008-09-18 19:56 <DIR> d--hs---- C:\FOUND.001 2008-09-18 19:52 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-09-18 19:52 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-09-18 18:34 . 2008-09-18 18:34 <DIR> d-------- C:\WINDOWS\$regcmp$ 2008-09-17 21:46 . 2008-09-17 21:46 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2008-09-17 21:32 . 1998-06-24 00:00 115,016 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-09-17 21:32 . 1998-07-22 00:00 102,912 --a------ C:\WINDOWS\system32\Vb6stkit.dll 2008-09-17 21:32 . 1998-07-22 00:00 102,160 --a------ C:\WINDOWS\system32\VB6KO.DLL 2008-09-17 21:32 . 2008-09-21 21:03 0 --a------ C:\WINDOWS\lgfwup.ini 2008-09-17 21:28 . 2001-03-08 18:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll 2008-09-17 21:27 . 2008-09-17 21:27 <DIR> d-------- C:\Program Files\CyberLink 2008-09-17 21:27 . 2003-03-18 20:14 499,712 --------- C:\WINDOWS\system32\msvcp71.dll 2008-09-17 21:27 . 2003-02-21 04:42 348,160 --------- C:\WINDOWS\system32\msvcr71.dll 2008-09-17 20:50 . 2008-09-17 20:50 <DIR> d--hs---- C:\FOUND.000 2008-09-17 20:35 . 2003-06-25 16:05 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe 2008-09-17 20:35 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerToysLicense.rtf 2008-09-17 20:33 . 2008-09-17 20:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-09-17 20:33 . 2008-05-27 10:50 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx 2008-09-17 20:33 . 2008-05-27 10:50 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts 2008-09-17 20:31 . 2008-09-17 20:31 <DIR> d-------- C:\OpenOffice.org 2.4 2008-09-17 20:31 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-09-17 20:30 . 2008-09-17 20:30 <DIR> d-------- C:\Program Files\Java 2008-09-17 20:30 . 2008-09-17 20:30 <DIR> d-------- C:\Program Files\Common Files\Java 2008-09-17 20:27 . 2008-09-17 20:27 <DIR> d-------- C:\IrfanView 2008-09-17 20:24 . 2008-09-17 20:24 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-09-17 20:24 . 2008-09-17 20:24 <DIR> d-------- C:\WINDOWS\Profiles 2008-09-17 20:24 . 2008-09-17 20:24 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-09-17 20:24 . 2008-09-17 20:24 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\InterTrust 2008-09-17 20:24 . 1998-10-29 14:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-09-17 20:19 . 2008-09-17 20:19 0 --a------ C:\WINDOWS\nsreg.dat 2008-09-17 20:14 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-09-17 20:14 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\dllcache\mouhid.sys 2008-09-17 20:14 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-09-17 20:14 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\dllcache\hidusb.sys 2008-09-17 20:03 . 2008-09-17 20:03 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-09-17 20:03 . 2008-09-17 20:03 <DIR> d-------- C:\Program Files\AVG 2008-09-17 20:03 . 2008-09-17 20:03 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-09-17 20:03 . 2008-09-17 20:03 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-09-17 20:03 . 2008-09-17 20:03 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-09-17 19:52 . 2008-09-17 19:52 <DIR> d-------- C:\Program Files\Yahoo! 2008-09-17 19:50 . 2008-09-17 19:50 25,992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2008-09-17 19:48 . 2008-09-17 19:48 <DIR> d--hs---- C:\Recycled 2008-09-17 19:47 . 2008-09-17 19:47 <DIR> d-------- C:\Documents and Settings\Connie\Application Data\UnH Solutions 2008-09-17 19:46 . 2008-09-17 19:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-09-17 19:46 . 2008-09-17 19:46 654 --a------ C:\WINDOWS\unins000.dat 2008-09-17 19:29 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-09-17 19:23 . 2008-09-17 20:28 316,640 --a------ C:\WINDOWS\WMSysPr9.prx 2008-09-17 19:22 . 2008-09-17 19:22 <DIR> d-------- C:\WINDOWS\provisioning 2008-09-17 19:22 . 2008-09-17 19:22 <DIR> d-------- C:\WINDOWS\peernet 2008-09-17 19:21 . 2008-09-17 19:22 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-09-17 19:19 . 2004-08-03 22:42 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-09-17 19:17 . 2008-09-17 19:17 <DIR> d-------- C:\WINDOWS\EHome 2008-09-17 19:15 . 2004-08-04 00:56 11,776 --------- C:\WINDOWS\system32\spnpinst.exe 2008-09-17 19:14 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig 2008-09-17 19:14 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat 2008-09-17 19:01 . 2008-09-17 19:01 <DIR> d---s---- C:\WINDOWS\system32\Microsoft 2008-09-17 18:55 . 2008-09-17 18:55 <DIR> d-------- C:\WINDOWS\system32\bits 2008-09-17 18:55 . 2004-08-04 00:56 438,784 --------- C:\WINDOWS\system32\xpob2res.dll 2008-09-17 18:55 . 2004-08-04 00:56 351,232 --a------ C:\WINDOWS\system32\winhttp.dll 2008-09-17 18:55 . 2004-08-04 00:56 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2008-09-17 18:55 . 2004-08-04 00:56 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll 2008-09-17 18:55 . 2004-08-04 00:56 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll 2008-09-17 18:52 . 2008-09-17 18:52 <DIR> d---s---- C:\Documents and Settings\Connie\UserData 2008-09-17 18:52 . 2008-07-18 22:09 563,912 --a------ C:\WINDOWS\system32\wuapi.dll 2008-09-17 18:52 . 2008-07-18 22:09 325,832 --a------ C:\WINDOWS\system32\wucltui.dll 2008-09-17 18:52 . 2008-07-18 22:09 215,752 --a------ C:\WINDOWS\system32\wuaucpl.cpl 2008-09-17 18:52 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll 2008-09-17 18:52 . 2008-07-18 22:10 36,552 --a------ C:\WINDOWS\system32\wups.dll 2008-09-17 18:52 . 2008-07-18 22:10 33,992 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-09-17 18:52 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-09-17 18:52 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-09-17 18:52 . 2008-07-18 22:08 20,680 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-09-17 18:51 . 2008-09-17 18:51 12,980 --a------ C:\WINDOWS\system32\wpa.bak 2008-09-17 18:48 . 2008-09-17 18:48 <DIR> d--h----- C:\Program Files\InstallShield Installation Information . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-18 02:46 72,748 ----a-w C:\WINDOWS\unins000.exe 2008-09-17 17:39 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2008-07-19 05:08 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IE Privacy Keeper"="f:\IE Privacy Keeper\IEPrivacyKeeper.exe" [2005-12-03 1015808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2002-12-27 4263936] "AVG8_TRAY"="f:\AVG8\avgtray.exe" [2008-09-29 1234712] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "WScheduler"="f:\SYSTEM~2\WScheduler.exe" [2006-05-27 74752] "OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 98304] C:\Documents and Settings\Connie\Start Menu\Programs\Startup\ hotspot.lnk - F:\Hotspot\hotspot.exe [2000-04-02 62976] OpenOffice.org 2.4.lnk - C:\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll cbdsks.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "F:\\AVG8\\avgemc.exe"= "F:\\AVG8\\avgupd.exe"= "E:\\BearShare\\BearShare.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-09-17 97928] R2 avg8emc;AVG Free8 E-mail Scanner;f:\AVG8\avgemc.exe [2008-09-17 875288] R2 avg8wd;AVG Free8 WatchDog;f:\AVG8\avgwdsvc.exe [2008-09-17 231704] R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-09-17 76040] *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . - - - - ORPHANS REMOVED - - - - ShellExecuteHooks-{1F5FDA83-4379-4C6A-94AD-CC7BC688505A} - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Connie\Application Data\Mozilla\Firefox\Profiles\vy73t4h4.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official FF -: plugin - C:\Program Files\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll FF -: plugin - F:\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - f:\Real Alternative\browser\plugins\nppl3260.dll FF -: plugin - f:\Real Alternative\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-29 14:45:05 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... C:\WINDOWS\system32\zshp1018.exe [3380] 0x823AE020 scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-09-29 14:45:38 ComboFix-quarantined-files.txt 2008-09-29 21:45:36 Pre-Run: 18,007,621,632 bytes free Post-Run: 17,996,824,576 bytes free 209