Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX KILLALL:: File:: C:\WINDOWS\SYSTEM32\ZoneAlarmIconUS.ico C:\WINDOWS\SYSTEM32\Atvbh.exe C:\WINDOWS\SYSTEM32\Cryct.exe C:\WINDOWS\SYSTEM32\Drt6.exe C:\WINDOWS\SYSTEM32\Ffewo.exe C:\WINDOWS\SYSTEM32\Hhpo38O.exe C:\WINDOWS\SYSTEM32\IkxNu62.exe C:\WINDOWS\SYSTEM32\Jdwu9.exe C:\WINDOWS\SYSTEM32\Mqv6jqA.exe C:\WINDOWS\SYSTEM32\Mrrl425.exe C:\WINDOWS\SYSTEM32\Nef2S3.exe C:\WINDOWS\SYSTEM32\NjqM9Y44.exe C:\WINDOWS\SYSTEM32\OjqM9Y44.exe C:\WINDOWS\SYSTEM32\UbgrYPnp.exe C:\WINDOWS\SYSTEM32\UvrI.exe C:\WINDOWS\SYSTEM32\Vacv1.exe C:\WINDOWS\SYSTEM32\YwcW.exe Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Bbdjb"=- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Post a new Combofix log. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: http://www.majorgeeks.com/ATF_Cleaner_d4949.html Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button.

0

In the Combofix script KILLALL will need to be at the top of the page in notepad.

0

Ok missed that last post. File:: was at the top. Should I run it again?

0

I ran it again with Killall:: at the top. Here is new log. Going to do the rest now. -------- ComboFix 08-08-13.02 - Robbie Hayes 2008-08-14 19:57:37.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.280 [GMT -4:00] Running from: C:\Documents and Settings\Robbie Hayes\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Robbie Hayes\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\SYSTEM32\Atvbh.exe C:\WINDOWS\SYSTEM32\Cryct.exe C:\WINDOWS\SYSTEM32\Drt6.exe C:\WINDOWS\SYSTEM32\Ffewo.exe C:\WINDOWS\SYSTEM32\Hhpo38O.exe C:\WINDOWS\SYSTEM32\IkxNu62.exe C:\WINDOWS\SYSTEM32\Jdwu9.exe C:\WINDOWS\SYSTEM32\Mqv6jqA.exe C:\WINDOWS\SYSTEM32\Mrrl425.exe C:\WINDOWS\SYSTEM32\Nef2S3.exe C:\WINDOWS\SYSTEM32\NjqM9Y44.exe C:\WINDOWS\SYSTEM32\OjqM9Y44.exe C:\WINDOWS\SYSTEM32\UbgrYPnp.exe C:\WINDOWS\SYSTEM32\UvrI.exe C:\WINDOWS\SYSTEM32\Vacv1.exe C:\WINDOWS\SYSTEM32\YwcW.exe C:\WINDOWS\SYSTEM32\ZoneAlarmIconUS.ico . ((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 ))))))))))))))))))))))))))))))) . 2008-08-13 23:47 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl 2008-08-13 23:45 . 2008-08-13 23:45 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-13 19:26 . 2008-08-13 19:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-13 19:26 . 2008-08-13 19:26 <DIR> d-------- C:\Documents and Settings\Robbie Hayes\Application Data\Malwarebytes 2008-08-13 19:26 . 2008-08-13 19:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-13 19:26 . 2008-07-30 20:15 38,472 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys 2008-08-13 19:26 . 2008-07-30 20:15 17,144 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys 2008-08-13 18:57 . 2007-03-29 08:56 409,600 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\qmgr.dll 2008-08-13 18:57 . 2007-03-29 08:56 18,944 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\qmgrprxy.dll 2008-08-13 18:57 . 2007-03-29 08:56 7,168 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bitsprx4.dll 2008-08-13 18:57 . 2007-03-29 08:56 7,168 --------- C:\WINDOWS\SYSTEM32\bitsprx4.dll 2008-08-12 23:50 . 2008-08-12 23:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-12 23:50 . 2008-08-13 09:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-10 14:58 . 2008-08-10 14:58 <DIR> d-------- C:\Documents and Settings\angel\Application Data\MySpace 2008-08-04 23:24 . 2008-08-14 20:12 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-04 23:24 . 2008-08-04 23:24 1,409 --a------ C:\WINDOWS\QTFont.for 2008-07-31 10:53 . 2008-07-31 10:53 <DIR> d-------- C:\Documents and Settings\Robbie Hayes\Application Data\Playrix Entertainment 2008-07-31 10:15 . 2008-07-31 10:15 <DIR> d-------- C:\Program Files\MSN Games 2008-07-24 21:38 . 2008-07-24 21:38 <DIR> d-------- C:\Documents and Settings\Robbie Hayes\Application Data\Reno 911 Paintball . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-14 04:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-08-14 03:47 --------- d-----w C:\Program Files\Java 2008-08-13 23:15 --------- d-----w C:\Documents and Settings\Robbie Hayes\Application Data\LimeWire 2008-08-12 02:39 --------- d-----w C:\Program Files\Keyboard Express 3 2008-07-31 14:54 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-14 14:19 --------- d-----w C:\Program Files\Shockwave.com 2008-07-09 20:02 --------- d-----w C:\Program Files\LimeWire 2008-07-09 05:30 --------- d-----w C:\Documents and Settings\gary\Application Data\MySpace 2008-07-05 21:07 --------- d-----w C:\Documents and Settings\david\Application Data\MySpace 2008-07-03 02:38 --------- d-----w C:\Program Files\MySpace 2008-07-03 02:38 --------- d-----w C:\Documents and Settings\Robbie Hayes\Application Data\MySpace 2008-07-02 04:21 --------- d-----w C:\Documents and Settings\david\Application Data\Apple Computer 2008-07-01 06:53 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-06-24 06:38 --------- d-----w C:\Documents and Settings\david\Application Data\AOL 2008-06-23 07:40 --------- d-----w C:\Documents and Settings\corina\Application Data\MSN6 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2006-01-26 04:53 37 -c--a-w C:\Documents and Settings\Robbie Hayes\Application Data\tvmcwrd.dll . ((((((((((((((((((((((((((((( snapshot@2008-08-14_ 0.09.58.81 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-15 00:02:03 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_590.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-04-17 19:27 9117696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 02:19 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 02:07 114688] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 21:47 204800] "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2005-10-13 23:26 69632] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2004-07-24 22:45 26112] "HostManager"="C:\Program Files\Common Files\AOL\1136361603\ee\AOLHostManager.exe" [2005-07-29 12:53 159832] "AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2004-10-20 10:40 34904] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-16 09:21 28672] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-04-17 19:27 9117696] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-04-20 20:04:09 124400] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 03:01:04 83360] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli scecli [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"= "C:\\Program Files\\iWin\\FamilyFeudOnlineParty\\Uninstall.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 10:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 10:37] R3 s3m;s3m;C:\WINDOWS\system32\DRIVERS\s3m.sys [2001-08-17 13:50] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-14 20:11:42 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\SYSTEM32\wscntfy.exe C:\Program Files\Common Files\AOL\1136361603\EE\AOLServiceHost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\SYSTEM32\verclsid.exe . ************************************************************************** . Completion time: 2008-08-14 20:19:56 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-15 00:19:42 ComboFix2.txt 2008-08-14 23:33:22 ComboFix3.txt 2008-08-14 04:10:53 Pre-Run: 60,241,747,968 bytes free Post-Run: 60,236,673,024 bytes free 161 --- E O F --- 2008-08-14 02:36:55

0

Run an online scan with Kaspersky from the following link: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply. Post a new Hijack This log please.

0

Running Kaspersky now.

0

It is not letting me post the logs. It keeps locking up on me. I have rebooted, but it didn't help. The following logs are CUT AND PASTE, not copy. No wonder it wouldn't post. This is ridculous!

0

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:22:20 AM, on 8/15/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Program Files\Common Files\AOL\1136361603\ee\AOLHostManager.exe C:\Program Files\Common Files\AOL\1136361603\ee\AOLServiceHost.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Robbie Hayes\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.computing.net/answers/se... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - SOFTWARE - (no file) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1136361603\ee\AOLHostManager.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU) O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - http://bannerfarm.ace.advertising.c... O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online... O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/sh... O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/J... O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewo... O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe -- End of file - 9473 bytes

0

-PART 1-- KASPERSKY ONLINE SCANNER 7 REPORT Friday, August 15, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Friday, August 15, 2008 02:17:18 Records in database: 1094195 ---------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ Scan statistics: Files scanned: 68129 Threat name: 19 Infected objects: 706 Suspicious objects: 0 Duration of the scan: 01:34:10 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030924113224.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030924113529.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030926013711.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030926032702.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030927200022.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030927201610.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030927203140.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030927224832.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030928034656.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030928190526.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030928191137.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030928192702.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030928225949.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030928232445.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929015743.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929021327.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929072854.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929180259.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929181829.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929183646.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929184242.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929185822.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929193540.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929193540.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929193540.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929195021.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929202144.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929202144.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929202144.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929203547.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929203547.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030929203547.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930000229.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930000229.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930000229.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930033142.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930150359.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930152010.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930152010.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930152010.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930220119.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930220119.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930220119.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930230921.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930232516.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930232516.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20030930232516.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001022200.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001022200.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001022200.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001022420.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001022420.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001022420.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001023317.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001023317.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001023317.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001035907.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001044405.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001155014.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001160611.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031001220303.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002012233.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002013242.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002034447.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002052206.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002053815.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002164653.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002170254.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002190221.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002203155.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031002204810.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031003022637.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031003071105.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031003072451.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031003152811.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031004001147.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031005112823.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031005164527.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031005170219.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031006012008.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031006184307.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031006185909.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031006204011.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031006205638.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031022203336.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031022204242.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031024054404.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031024072106.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031024083840.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031024151932.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031024160838.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031024222146.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031209210930.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20031209211901.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040113160910.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040113183546.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040113183727.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040113184148.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040113233625.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040114033731.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040114042341.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040114043628.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040114235931.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040116073025.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040125075006.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040125111744.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040125132301.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040126073422.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040126085245.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040128204648.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040205211734.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20040206174143.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060106200152.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060106200152.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060106200152.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060111194554.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060111194554.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060111194554.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060115191630.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060115191630.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060115191630.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060118151900.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060118151900.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060118151900.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060118160618.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060120154850.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060120154850.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060120154850.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060120182030.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060120182030.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060120182030.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060122114341.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060122114341.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060122114341.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060123182823.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060123182823.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060123182823.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060125182940.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060125182940.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060125182940.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060128210506.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060128210506.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060128210506.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060128210846.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060128210846.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060128210846.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060131181733.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060131181733.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1

0

PART 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060131181733.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060214234634.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060214234634.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060214234634.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060216114622.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060216114622.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060216114622.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060217201354.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060217201354.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060217201354.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060217203039.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060217203039.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060217203039.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060224185252.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060224185252.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060224185252.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060224185441.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060228184027.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060228184027.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060228184027.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060228185659.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060302065530.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060302182140.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060302182140.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060302183809.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060302183809.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060304092139.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060304092139.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060304092139.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060304093756.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060304093756.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060309213856.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060309213856.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060309213856.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060309215502.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060310234240.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060310234240.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060310234240.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060310235858.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060310235858.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060311022922.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060311022922.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060311022922.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060311024539.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060311093119.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060311093119.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060311093119.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060311094734.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060313182646.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060313182646.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060313182646.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060313184618.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060313184618.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060313184618.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060314153547.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060314153547.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060314153547.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060314155214.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060315090406.zip Infected: not-a-virus:AdWare.Win32.Wintol.ah 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060315090406.zip Infected: not-a-virus:AdWare.Win32.Wintol.al 1 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060315090406.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060315092043.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060316195145.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060316200805.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060318023912.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060318025522.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060321170806.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060321172422.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060322114406.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060322120017.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060322125155.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060322131444.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060331214157.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060331214338.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060402101537.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060402103151.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060416182446.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060416182718.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060420161731.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060420162030.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060422160334.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060422162013.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060422195754.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060422201413.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060509211037.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060509211242.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060514093615.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060514095234.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060517000908.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060608093325.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060608094955.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060614142710.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060614142919.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060614143604.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060621081229.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060621081503.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060621084100.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060628221944.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060628222135.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060705194152.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060705194433.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060719100009.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060719101626.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060724151728.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060724151942.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060728204723.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060728223220.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060731154943.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060731160623.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060903144233.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060903144436.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060926211528.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20060926213145.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061005043815.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061005044005.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061021023033.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061021023210.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061021024641.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061021030151.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061107093011.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061107093212.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061219122151.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061226215846.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20061226220047.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070115111519.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070115111751.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070127141634.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070302143431.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070302143616.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070302144211.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070302225557.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070302231156.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070302233527.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070302235120.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070303000244.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070303001858.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070303170853.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070303172457.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070316121417.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070316123023.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070316144313.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070413120738.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070413120948.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070413153213.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070423103237.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070423103632.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070423105242.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070424084243.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070429123525.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070519034157.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070519052730.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070519054720.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2

0

PART 3 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070519063234.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070519071118.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070519203949.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070520194704.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070520201933.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070520213920.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070520233258.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070521024850.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070521045425.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070521050435.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070521225455.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20070522000912.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080414164515.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080414224009.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415004054.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415082501.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415084151.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415090443.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415090906.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415094818.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415102419.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415112506.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415113820.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415114255.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415115424.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415120131.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415123419.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415123924.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415130845.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415131517.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415155545.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415160027.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415160709.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415163356.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415163554.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415165909.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415180444.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415183502.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415185146.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415204250.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415204813.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080415211830.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416094155.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416094427.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416115532.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416130134.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416131801.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416144238.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416150301.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416154901.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416155722.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416162814.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416182315.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416184515.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080416215923.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080417074549.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080417080300.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080417181756.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080417183439.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080418013023.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080418013504.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080418015421.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080418021056.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080418083808.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080418085501.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080419004910.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080419010112.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080419020805.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080420161130.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080420171735.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine\20080420212113.zip Infected: not-a-virus:AdWare.Win32.Wintol.af 2 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\15\390179cf-2f2aaec6 Infected: Trojan.Win32.Revop.e 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\57\538bb179-450f842e Infected: Trojan-Downloader.Java.OpenStream.ac 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\62\34a947be-4bc7416d Infected: Trojan-Downloader.Java.OpenConnection.ao 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\62\34a947be-4bc7416d Infected: Trojan.Java.ClassLoader.au 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\62\34a947be-4bc7416d Infected: Trojan-Downloader.Java.Agent.a 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-53b42299-5fb4c43f.zip Infected: Trojan.Win32.Revop.e 1 C:\Documents and Settings\Robbie Hayes\Desktop\DEVONS\garys pics\ninas\hpw you gonna act like that.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\cause im in love with you.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\cry remix slowed down.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\jon young 2008.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\lookin boy slowed down.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\slowed down lookin boy.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\think god im pubic hair.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\traptaclar.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\we belong to jesus.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Program Files\Alwil Software\Avast4\DATA\moved\attrib.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.ek 1 C:\Program Files\Common Files\aolback\Comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Atvbh.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Cryct.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Drt6.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Ffewo.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Hhpo38O.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\IkxNu62.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Jdwu9.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Mqv6jqA.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Mrrl425.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Nef2S3.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\NjqM9Y44.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\OjqM9Y44.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\UbgrYPnp.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\UvrI.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\Vacv1.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\YwcW.exe.vir Infected: Trojan-Downloader.Win32.VB.em 1 C:\WINDOWS\gonspgrbw.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.az 1 C:\WINDOWS\SYSTEM32\atiupdate5.exe Infected: not-a-virus:AdWare.Win32.Adtomi.e 1 C:\WINDOWS\SYSTEM32\BO2802040113.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d 1 C:\WINDOWS\SYSTEM32\BO2804040128.exe Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d 1 C:\WINDOWS\SYSTEM32\calsdr.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.b 1 C:\WINDOWS\SYSTEM32\calsdr.exe Infected: Trojan-Dropper.Win32.Small.ff 1 C:\WINDOWS\SYSTEM32\iksd.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1 C:\WINDOWS\SYSTEM32\jaivt.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1 C:\WINDOWS\SYSTEM32\аttrib.exe Infected: not-a-virus:AdWare.Win32.PurityScan.id 1 The selected area was scanned.

0

Should I take my other Windows computer off the network with this one? Cause mine is CLEAN.

0

No, it should be ok. Navigate to and delete the contents of these folders, do not delete the folders: C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\Quarantine C:\QooBox\Quarantine Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\WINDOWS\gonspgrbw.exe C:\WINDOWS\SYSTEM32\atiupdate5.exe C:\WINDOWS\SYSTEM32\BO2802040113.dll C:\WINDOWS\SYSTEM32\BO2804040128.exe C:\WINDOWS\SYSTEM32\calsdr.dll C:\WINDOWS\SYSTEM32\calsdr.exe C:\WINDOWS\SYSTEM32\iksd.dll C:\WINDOWS\SYSTEM32\jaivt.dll C:\WINDOWS\SYSTEM32\аttrib.exe XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Run The Kaspersky online scan again and post the results please.

0

Doing the above now, will post back when finished.

0

Do I want to update combofix?

0

Yes, and a Hijack This log also, you can put them all in the same post

0

---------------------- KASPERSKY ONLINE SCANNER 7 REPORT Friday, August 15, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, August 16, 2008 01:11:28 Records in database: 1096789 ---------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ Scan statistics: Files scanned: 67786 Threat name: 15 Infected objects: 27 Suspicious objects: 0 Duration of the scan: 01:28:18 File name / Threat name / Threats count C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\15\390179cf-2f2aaec6 Infected: Trojan.Win32.Revop.e 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\57\538bb179-450f842e Infected: Trojan-Downloader.Java.OpenStream.ac 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\62\34a947be-4bc7416d Infected: Trojan-Downloader.Java.OpenConnection.ao 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\62\34a947be-4bc7416d Infected: Trojan.Java.ClassLoader.au 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\6.0\62\34a947be-4bc7416d Infected: Trojan-Downloader.Java.Agent.a 1 C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-53b42299-5fb4c43f.zip Infected: Trojan.Win32.Revop.e 1 C:\Documents and Settings\Robbie Hayes\Desktop\DEVONS\garys pics\ninas\hpw you gonna act like that.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\cause im in love with you.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\cry remix slowed down.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\jon young 2008.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\lookin boy slowed down.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\slowed down lookin boy.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\think god im pubic hair.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\traptaclar.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\we belong to jesus.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Program Files\Alwil Software\Avast4\DATA\moved\attrib.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.ek 1 C:\Program Files\Common Files\aolback\Comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1 C:\QooBox\Quarantine\C\WINDOWS\gonspgrbw.exe.vir Infected: not-a-virus:AdWare.Win32.BetterInternet.az 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP765\A0455386.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.az 1 C:\WINDOWS\SYSTEM32\atiupdate5.exe Infected: not-a-virus:AdWare.Win32.Adtomi.e 1 C:\WINDOWS\SYSTEM32\BO2802040113.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d 1 C:\WINDOWS\SYSTEM32\BO2804040128.exe Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d 1 C:\WINDOWS\SYSTEM32\calsdr.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.b 1 C:\WINDOWS\SYSTEM32\calsdr.exe Infected: Trojan-Dropper.Win32.Small.ff 1 C:\WINDOWS\SYSTEM32\iksd.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1 C:\WINDOWS\SYSTEM32\jaivt.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1 C:\WINDOWS\SYSTEM32\аttrib.exe Infected: not-a-virus:AdWare.Win32.PurityScan.id 1 The selected area was scanned. ------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:57:35 PM, on 8/15/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Common Files\AOL\1136361603\ee\AOLHostManager.exe C:\Program Files\Common Files\AOL\1136361603\ee\AOLServiceHost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.exe C:\Documents and Settings\Robbie Hayes\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.computing.net/answers/se... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - SOFTWARE - (no file) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1136361603\ee\AOLHostManager.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU) O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - http://bannerfarm.ace.advertising.c... O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online... O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/sh... O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/J... O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewo... O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe -- End of file - 9505 bytes

0

I was just looking thru the logs. Is the Java infected again?

0

Run Hijack This, close all windows and browsers execpt Hijack this, place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - SOFTWARE - (no file) O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - http://bannerfarm.ace.advertising.c... Exit Hijack This Go to start> control panel > Java> temporary internet filews> settings> delete files> yes> ok. Set up the computer to view hidden files: To show hidden files do the following: Click Start > My Computer On the Tools menu, click Folder Options. Click the View tab. Uncheck Hide file extensions for known file types. Uncheck Hide protected operating system files. Under the Hidden files folder, locate and check Show hidden files and folders. If you see a warning message, click Yes. Click Apply > OK. Navigate to and delete these files if found: C:\WINDOWS\gonspgrbw.exe C:\WINDOWS\SYSTEM32\atiupdate5.exe C:\WINDOWS\SYSTEM32\BO2802040113.dll C:\WINDOWS\SYSTEM32\BO2804040128.exe C:\WINDOWS\SYSTEM32\calsdr.dll C:\WINDOWS\SYSTEM32\calsdr.exe C:\WINDOWS\SYSTEM32\iksd.dll C:\WINDOWS\SYSTEM32\jaivt.dll C:\WINDOWS\SYSTEM32\аttrib.exe C:\Documents and Settings\Robbie Hayes\Desktop\DEVONS\garys pics\ninas\hpw you gonna act like that.mp3 Navigate to and delete this folder: Go to start> control panel> add/remove programs and uninstall Limewire, you can reinstall it later. You can see the infected Limewire files in the last online scan, you could delete those if you prefere instaed of uninstalling Limewire then post a new online scan please.

0

Did a search on C:\WINDOWS\gonspgrbw.exe but could not find it. Running Kscan now.

0

---------------------- KASPERSKY ONLINE SCANNER 7 REPORT Saturday, August 16, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, August 16, 2008 04:56:44 Records in database: 1097285 ---------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ Scan statistics: Files scanned: 67972 Threat name: 11 Infected objects: 22 Suspicious objects: 0 Duration of the scan: 01:39:36 File name / Threat name / Threats count C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-53b42299-5fb4c43f.zip Infected: Trojan.Win32.Revop.e 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\cause im in love with you.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\cry remix slowed down.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\jon young 2008.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\lookin boy slowed down.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\slowed down lookin boy.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\think god im pubic hair.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\traptaclar.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire\Saved\we belong to jesus.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Program Files\Alwil Software\Avast4\DATA\moved\attrib.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.ek 1 C:\Program Files\Common Files\aolback\Comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1 C:\QooBox\Quarantine\C\WINDOWS\gonspgrbw.exe.vir Infected: not-a-virus:AdWare.Win32.BetterInternet.az 1 C:\RECYCLER\S-1-5-21-204744980-3949416596-1615344775-1007\Dc1.exe Infected: not-a-virus:AdWare.Win32.Adtomi.e 1 C:\RECYCLER\S-1-5-21-204744980-3949416596-1615344775-1007\Dc2.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d 1 C:\RECYCLER\S-1-5-21-204744980-3949416596-1615344775-1007\Dc3.exe Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d 1 C:\RECYCLER\S-1-5-21-204744980-3949416596-1615344775-1007\Dc4.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.b 1 C:\RECYCLER\S-1-5-21-204744980-3949416596-1615344775-1007\Dc5.exe Infected: Trojan-Dropper.Win32.Small.ff 1 C:\RECYCLER\S-1-5-21-204744980-3949416596-1615344775-1007\Dc6.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1 C:\RECYCLER\S-1-5-21-204744980-3949416596-1615344775-1007\Dc7.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1 C:\RECYCLER\S-1-5-21-204744980-3949416596-1615344775-1007\Dc9.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP765\A0455386.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.az 1 C:\WINDOWS\SYSTEM32\аttrib.exe Infected: not-a-virus:AdWare.Win32.PurityScan.id 1 The selected area was scanned.

0

Looking better, this appears to be an old trojan we called "nail" or a new version of "lop.com". Navigate to and delete this folder if found: C:\Documents and Settings\Robbie Hayes\My Documents\LimeWire Clean the java cache again, go to start> control panel > Java> temporary internet filews> settings> delete files> yes> ok. Emptry the restore folder again. Download SDFix.exe and save it to your Desktop. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. Remember to re-enable the protection again afterwards before connecting to the Internet. 1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. 2. Open the c:\SDFix folder and double click RunThis.cmd to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. 3. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. 4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt

0

[b]SDFix: Version 1.216 [/b] Run by david on Sat 08/16/2008 at 03:24 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\Documents and Settings\david\Desktop\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\Documents and Settings\david\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com\settings.sol - Deleted Folder C:\Documents and Settings\david\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-16 15:40:37 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"="C:\\WINDOWS\\SYSTEM32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\Program Files\\iWin\\FamilyFeudOnlineParty\\Uninstall.exe"="C:\\Program Files\\iWin\\FamilyFeudOnlineParty\\Uninstall.exe:*:Enabled:Uninstall" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe:*:Enabled:MySpaceIM" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" [b]Remaining Files [/b]: File Backups: - C:\DOCUME~1\david\Desktop\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 4 Jan 2006 9,646 A..H. --- "C:\TEMP\t4.bak" Thu 13 Apr 2006 8,859 A..H. --- "C:\TEMP\t4.bak1" Fri 14 Apr 2006 8,096 A..H. --- "C:\TEMP\t4.bak2" Sat 15 Apr 2006 2,571 A..H. --- "C:\TEMP\t4.bak3" Thu 20 Apr 2006 1,912 A..H. --- "C:\TEMP\t4.bak4" Sun 4 Apr 2004 0 A..H. --- "C:\WINDOWS\dex.exe.tmp" Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 7 Jul 2008 2,156,368 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Tue 1 Jul 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Thu 15 May 2003 43,008 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe" Wed 13 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0d3b5d19cc06db007bbe6584808bfa9e\BITE.tmp" Wed 13 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BITA.tmp" [b]Finished![/b]

0

Make sure Spybot's tea timer is off, it will interfere with the fixes by reinstalling the files we are try to remove and damage some of the tools we use which can cause unexpected results. Go to the this link: Disable Realtime Protection Follow their directions to disable any realtime protection (tea timer or any other that you may have) as it will interfere with the fix by reinstalling the corrupt files. Copy the text below between the X's into notepad, making sure the first line is at the top off the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX attrib -s -h -r C:\WINDOWS\SYSTEM32\аttrib.exe del C:\WINDOWS\SYSTEM32\аttrib.exe attrib -h -s c:\recycler del c:\recycler XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Once copied into notepad click file> save> in the save in box select desktop then in the file name box type cla.bat then click save. You should now have a cla.bat file on you desktop. If not let me know. Restart in Safe Mode, once in safe mode double click Clr.bat,a dos window will appear and disappear quickly. To get into Windows XP Safe Mode, restart your computer and, just before Windows starts to load, tap the F8 key a few times. Choose Safe Mode from the menu that will appear and press Enter.(It may take you a couple of tries to get into safe mode) After the batch file runs restart the computer in normal mode . Post a new Combofix log and a new kaspersky scan please.

0

I have totally uninstalled Spybot and Avast and will reinstall when everything is done. Teatimer should not be running. I didn't install it. I never do. Oh well. Will post when I'm done.

0

ComboFix 08-08-14.05 - Robbie Hayes 2008-08-16 17:52:35.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.236 [GMT -4:00] Running from: C:\Documents and Settings\Robbie Hayes\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-16 to 2008-08-16 ))))))))))))))))))))))))))))))) . 2008-08-16 15:20 . 2008-08-16 15:20 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-13 23:47 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl 2008-08-13 23:45 . 2008-08-13 23:45 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-13 19:26 . 2008-08-13 19:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-13 19:26 . 2008-08-13 19:26 <DIR> d-------- C:\Documents and Settings\Robbie Hayes\Application Data\Malwarebytes 2008-08-13 19:26 . 2008-08-13 19:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-13 19:26 . 2008-07-30 20:15 38,472 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys 2008-08-13 19:26 . 2008-07-30 20:15 17,144 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys 2008-08-13 18:57 . 2007-03-29 08:56 409,600 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\qmgr.dll 2008-08-13 18:57 . 2007-03-29 08:56 18,944 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\qmgrprxy.dll 2008-08-13 18:57 . 2007-03-29 08:56 7,168 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bitsprx4.dll 2008-08-13 18:57 . 2007-03-29 08:56 7,168 --------- C:\WINDOWS\SYSTEM32\bitsprx4.dll 2008-08-12 23:50 . 2008-08-16 17:29 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-12 23:50 . 2008-08-16 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-10 14:58 . 2008-08-10 14:58 <DIR> d-------- C:\Documents and Settings\angel\Application Data\MySpace 2008-08-04 23:24 . 2008-08-16 17:59 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-04 23:24 . 2008-08-04 23:24 1,409 --a------ C:\WINDOWS\QTFont.for 2008-07-31 10:53 . 2008-07-31 10:53 <DIR> d-------- C:\Documents and Settings\Robbie Hayes\Application Data\Playrix Entertainment 2008-07-31 10:15 . 2008-07-31 10:15 <DIR> d-------- C:\Program Files\MSN Games 2008-07-24 21:38 . 2008-07-24 21:38 <DIR> d-------- C:\Documents and Settings\Robbie Hayes\Application Data\Reno 911 Paintball . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-16 06:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-08-16 04:28 --------- d-----w C:\Program Files\LimeWire 2008-08-14 03:47 --------- d-----w C:\Program Files\Java 2008-08-13 23:15 --------- d-----w C:\Documents and Settings\Robbie Hayes\Application Data\LimeWire 2008-08-12 02:39 --------- d-----w C:\Program Files\Keyboard Express 3 2008-07-31 14:54 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-14 14:19 --------- d-----w C:\Program Files\Shockwave.com 2008-07-09 05:30 --------- d-----w C:\Documents and Settings\gary\Application Data\MySpace 2008-07-05 21:07 --------- d-----w C:\Documents and Settings\david\Application Data\MySpace 2008-07-03 02:38 --------- d-----w C:\Program Files\MySpace 2008-07-03 02:38 --------- d-----w C:\Documents and Settings\Robbie Hayes\Application Data\MySpace 2008-07-02 04:21 --------- d-----w C:\Documents and Settings\david\Application Data\Apple Computer 2008-07-01 06:53 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-06-24 06:38 --------- d-----w C:\Documents and Settings\david\Application Data\AOL 2008-06-23 07:40 --------- d-----w C:\Documents and Settings\corina\Application Data\MSN6 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2006-01-26 04:53 37 -c--a-w C:\Documents and Settings\Robbie Hayes\Application Data\tvmcwrd.dll . ((((((((((((((((((((((((((((( snapshot@2008-08-15_19.29.14.29 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 20:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.exe + 2008-08-16 19:20:54 4,136,960 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-16 19:20:54 151,552 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 20:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.exe + 2008-08-16 19:20:37 4,136,960 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-16 19:20:37 151,552 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-06-03 01:18:47 2,560 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\cagicon.exe + 2008-08-16 19:05:12 2,560 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\cagicon.exe - 2008-06-03 01:18:47 34,304 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\misc.exe + 2008-08-16 19:05:12 34,304 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\misc.exe - 2008-06-03 01:18:47 8,192 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\mspicons.exe + 2008-08-16 19:05:12 8,192 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\mspicons.exe - 2008-06-03 01:18:47 3,584 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\opwicon.exe + 2008-08-16 19:05:12 3,584 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\opwicon.exe - 2008-06-03 01:18:47 16,384 -c--a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\PEicons.exe + 2008-08-16 19:05:12 16,384 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\PEicons.exe - 2008-06-03 01:18:47 22,528 -c--a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\unbndico.exe + 2008-08-16 19:05:12 22,528 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\unbndico.exe - 2008-06-03 01:18:47 45,056 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\wordicon.exe + 2008-08-16 19:05:12 45,056 ----a-r C:\WINDOWS\Installer\{911B0409-6000-11D3-8CFE-0050048383C9}\wordicon.exe - 2008-08-13 19:50:48 1,528 ----a-w C:\WINDOWS\SYSTEM32\d3d9caps.dat + 2008-08-16 20:06:17 2,188 ----a-w C:\WINDOWS\SYSTEM32\d3d9caps.dat - 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\SYSTEM32\MRT.exe + 2008-08-05 15:11:02 15,888,504 ----a-w C:\WINDOWS\SYSTEM32\MRT.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-04-17 19:27 9117696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 02:19 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 02:07 114688] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 21:47 204800] "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2005-10-13 23:26 69632] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2004-07-24 22:45 26112] "HostManager"="C:\Program Files\Common Files\AOL\1136361603\ee\AOLHostManager.exe" [2005-07-29 12:53 159832] "AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2004-10-20 10:40 34904] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-16 09:21 28672] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-04-17 19:27 9117696] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-04-20 20:04:09 124400] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 03:01:04 83360] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli scecli [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"= "C:\\Program Files\\iWin\\FamilyFeudOnlineParty\\Uninstall.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R3 s3m;s3m;C:\WINDOWS\system32\DRIVERS\s3m.sys [2001-08-17 13:50] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [] . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Robbie Hayes\Application Data\Mozilla\Firefox\Profiles\cfmq8on4.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-16 17:58:54 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\SYSTEM32\wscntfy.exe C:\Program Files\Common Files\AOL\1136361603\EE\AOLServiceHost.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-08-16 18:06:49 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-16 22:06:25 ComboFix2.txt 2008-08-15 23:30:12 ComboFix3.txt 2008-08-15 00:19:57 Pre-Run: 63,406,649,344 bytes free Post-Run: 63,441,018,880 bytes free 160 --- E O F --- 2008-08-16 19:05:16 Running Kscan now

0

I would not be online without an antivirus running.

0

---------------------- KASPERSKY ONLINE SCANNER 7 REPORT Saturday, August 16, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, August 16, 2008 22:59:46 Records in database: 1099301 ---------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ Scan statistics: Files scanned: 67466 Threat name: 4 Infected objects: 4 Suspicious objects: 0 Duration of the scan: 01:25:12 File name / Threat name / Threats count C:\Documents and Settings\Robbie Hayes\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-53b42299-5fb4c43f.zip Infected: Trojan.Win32.Revop.e 1 C:\Program Files\Common Files\aolback\Comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1 C:\QooBox\Quarantine\C\WINDOWS\gonspgrbw.exe.vir Infected: not-a-virus:AdWare.Win32.BetterInternet.az 1 C:\WINDOWS\SYSTEM32\Adobe\Shockwave 11\gt.exe Infected: Trojan-Downloader.Win32.Agent.aaza 1 The selected area was scanned.

0

You've done a really good job. It can be frustrating removing these baddies. Many people give up before they even get started. Go to start> run> type in Combofix /u (note the space after combofix> then press enter. This should uninstall Combofix and remove the C:\Qoobox folder. Navigate to and delete thus file if found: C:\WINDOWS\SYSTEM32\Adobe\Shockwave 11\gt.exe and if you get any errors just uninstall it and download the newest version. Reinstall java per these instructions, you already have the newest version so you will need to uninstall it and any other version before you install it again.. Download the latest version of java from this link Java Click on the JRE 6 Update 7 download button. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version. The aol file I am not worried about. Empty the restore folder again and run ATF Cleaner again. Then you can uninstall/delete the tools we used to clean the computer. You may want to keep ATF Cleaner and tell your client to run once a week. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version. Also you should defrag the computer if you haven't done so already. How is the computer operating?

0

The computer is running better than it did. Thank you so much for your help. It's very appreciated. I am gonna run ccleaner then do a defrag. Should I leave the Malwarebytes on here? Where did you learn how to do all this? You are brilliant!

0

Thanks for the kind words, just got tired of paying the high price of malware removal and joined some of the spyware removal forums to learn how to help. You can keep Malwarebytes, it needs to be updated before each use of course. Glad we could help.

0