I have a trojan virus that is quarantined every time i run webroot antivirus. I don't understand why it keeps coming up if my antivirus is quarantining it. Also I get loads of pop ups when i'm on the internet. My system is running very slow. I need help cleaning up my computer.

Please download Malwarebytes' Anti-Malware from one of these sites: MalwareBytes1 MalwareBytes2 1. Double Click mbam-setup.exe to install the application. 2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. 3. If an update is found, it will download and install the latest version. 4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. 5. When the scan is complete, click OK, then Show Results to view the results. 6. Make sure that everything found is checked, and click Remove Selected. 7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. 8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. 9. Copy&Paste the entire report in your next reply. Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

I ran malware bytes and a blue screen with code came up in the middle of running and rebooted my computer. I ran it again and it finished with the following results: Malwarebytes' Anti-Malware 1.30 Database version: 1361 Windows 5.1.2600 Service Pack 3 11/4/2008 2:16:56 AM mbam-log-2008-11-04 (02-16-56).txt Scan type: Quick Scan Objects scanned: 69200 Time elapsed: 18 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 2 Registry Keys Infected: 40 Registry Values Infected: 3 Registry Data Items Infected: 2 Folders Infected: 10 Files Infected: 13 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\ddcDvuSl.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\inlulu.dll (Trojan.Vundo) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2b0c0796-adc7-48a7-a90e-959b971ab0d0} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{2b0c0796-adc7-48a7-a90e-959b971ab0d0} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{786d2c6c-a8db-444c-8fa1-2c4eeb7a4efa} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{786d2c6c-a8db-444c-8fa1-2c4eeb7a4efa} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2b0c0796-adc7-48a7-a90e-959b971ab0d0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\imeshmediabar.stockbar (Adware.SoftMate) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\imeshmediabar.stockbar.1 (Adware.SoftMate) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\xbtb01621.ietoolbar (Adware.SoftMate) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\xbtb01621.ietoolbar.1 (Adware.SoftMate) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\xbtb01621.xbtb01621 (Adware.SoftMate) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\xbtb01621.xbtb01621.1 (Adware.SoftMate) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{986a8ac1-ab4d-4f41-9068-4b01c0197867} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{a0e1054b-01ee-4d57-a059-4d99f339709f} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbtoolbar.temperaturebarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbtoolbar.temperaturebarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{299b5fac-2168-4a5d-a67d-aa4c8f8055da} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\Zango@Zango.com (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\zango 10.1.181.0 (Adware.Zango) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\ddcdvusl -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ddcdvusl -> Delete on reboot. Folders Infected: C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\XPShield (Rogue.XPShield) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\inlulu.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\ddcDvuSl.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\lSuvDcdd.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lSuvDcdd.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\SysNotifier.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\WINDOWS\system32\xitnisas.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\History\search2 (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\XPShield\XP-Shield.exe (Rogue.XPShield) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSotub.dll (Rootkit.Agent) -> Delete on reboot. C:\WINDOWS\system32\drivers\TDSSmhct.sys (Rootkit.Agent) -> Delete on reboot. I then ran hijack this with the following results: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:27:00 AM, on 11/4/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\WINDOWS\Explorer.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\Program Files\McAfee\VirusScan\McShield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Sony\VAIO Power Management\SPMgr.exe C:\Program Files\Sony\ISB Utility\ISBMgr.exe C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ICO.exe C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\FotomatDeviceConnect.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Pure Networks\Network Magic\nmapp.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Sony\VAIO Event Service\VESMgr.exe C:\Program Files\Common Files\AOL\1154548953\ee\AOLSoftware.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\Veoh Networks\Veoh\VeohClient.exe C:\PROGRA~1\Comcast\COMCAS~1\data\xtras\mssysmgr.exe C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/s... R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sony.com/vaiopeople R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/s... R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file) O2 - BHO: (no name) - {1CAD29DF-1D6D-41A2-8C55-EAA2C7EDCDEB} - C:\WINDOWS\msagent\chars\fastnati.dll (file missing) O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL O2 - BHO: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.7.0\ViewBarBHO.dll O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\IEViewBar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL O3 - Toolbar: WeatherBug Browser Bar - powered by MyWebSearch - {8EAB99C9-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe" O4 - HKLM\..\Run: [ehTray] "C:\WINDOWS\ehome\ehtray.exe" O4 - HKLM\..\Run: [igfxtray] "C:\WINDOWS\system32\igfxtray.exe" O4 - HKLM\..\Run: [igfxhkcmd] "C:\WINDOWS\system32\hkcmd.exe" O4 - HKLM\..\Run: [igfxpers] "C:\WINDOWS\system32\igfxpers.exe" O4 - HKLM\..\Run: [VAIO Recovery] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe" O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] "C:\WINDOWS\system32\ICO.exe" O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.exe" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Switcher.exe] "C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe" O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe" O4 - HKLM\..\Run: [ViewMgr] "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] "C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\FotomatDeviceConnect.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" O4 - HKLM\..\Run: [Picasa Media Detector] "C:\Program Files\Picasa2\PicasaMediaDetector.exe" O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1154548953\ee\AOLSoftware.exe" O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey O4 - HKLM\..\Run: [HPDJ Taskbar Utility] "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [DeviceDiscovery] "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [KernelFaultCheck] "C:\WINDOWS\system32\dumprep.exe" 0 -k O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [SsAAD.exe] "C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Comcast\COMCAS~1\data\xtras\mssysmgr.exe O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople O16 - DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} (VaioInfo.CMClass) - http://esupport.sony.com/VaioInfo.CAB O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g... O20 - AppInit_DLLs: ebdtbw.dll inlulu.dll O20 - Winlogon Notify: fastnati - C:\WINDOWS\msagent\chars\fastnati.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SonicStageMonitoring - Sony Corporation - C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe -- End of file - 18218 bytes Thank you for your help.

Your java is out of date and may have been exploited. Download the latest version of java from this link Java Click on the JRE 6 Update 10 download button. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-6u10-windows-i586-p.exe to install the newest version. Download SDFix.exe and save it to your Desktop. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. Remember to re-enable the protection again afterwards before connecting to the Internet. 1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. 2. Open the c:\SDFix folder and double click RunThis.cmd to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. 3. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. 4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt

[b]SDFix: Version 1.239 [/b] Run by Sorber on Wed 11/05/2008 at 07:44 AM Microsoft Windows XP [Version 5.1.2600] Running From: C:\Documents and Settings\Sorber\Desktop\SDFix [b]Checking Services [/b]: [b]Name [/b]: TDSSserv.sys [b]Path [/b]: \systemroot\system32\drivers\TDSSmhct.sys TDSSserv.sys - Deleted Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\drivers\TDSSmhct.sys - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-05 07:58:27 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\Common Files\\AOL\\1154548953\\ee\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1154548953\\ee\\aolsoftware.exe:*:Enabled:AOL Services" "C:\\Program Files\\Limewire Pro\\LimeWire\\LimeWire.exe"="C:\\Program Files\\Limewire Pro\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.exe"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Enabled:Morpheus" "C:\\Program Files\\Common Files\\AOL\\acs\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\acs\\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialer" "C:\\Program Files\\Common Files\\AOL\\acs\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\acs\\AOLacsd.exe:*:Enabled:AOL Connectivity Service" "C:\\Program Files\\AOL 9.1\\waol.exe"="C:\\Program Files\\AOL 9.1\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe:*:Enabled:AOL TopSpeed" "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"="C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe:*:Enabled:AOL System Information" "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe:*:Enabled:McAfee Network Agent" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Pure Networks\\Network Magic\\nmsrvc.exe"="C:\\Program Files\\Pure Networks\\Network Magic\\nmsrvc.exe:LocalSubNet:Enabled:Pure Networks Network Magic Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\DOCUME~1\Sorber\Desktop\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Mon 25 Sep 2006 4,715 A..H. --- "C:\TEMP\t4.bak" Fri 11 Nov 2005 4,126,240 ...H. --- "C:\Program Files\Picasa2\setup.exe" Wed 18 Oct 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 1 Sep 2007 1,334 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti23.tmp" Fri 12 Sep 2008 20,487 A.SHR --- "C:\Program Files\McAfee\MQC\MRU.bak" Fri 12 Sep 2008 265 A.SHR --- "C:\Program Files\McAfee\MQC\qcconf.bak" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS00080710-51BB-4FBA-954F-AEC505DD6DE0.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS061C2C1F-1090-40DA-8CC9-70F6A97219B4.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS08FD657B-8BCB-4C6C-983D-D674E3B2FCC6.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS0A96C46D-0F62-43AE-820F-6F3870B9AF74.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS0C06E54D-ACB3-44C5-95CD-92073AE0D114.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS0E05F422-E827-4184-B3E6-F2E5D28B6F71.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS1348CA51-092C-49AE-808C-1B0CBEC49F56.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS13B81C15-F5F6-4FD1-B8FB-B148972A11A3.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS158036C1-5066-4E18-8EC2-70D4C1CA0D53.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS1853CCF5-C4B3-449A-8522-0C260C262B55.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS1A166B1A-E177-4BF2-9648-3ADACAAF40E8.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS1AE1DD24-3D1B-481F-804F-B9C1ADBC0646.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS1D6B1288-B84C-4304-9C45-E2DC359CFE9D.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS20254F5A-3BE7-4C26-BFF0-A743CFA11C31.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS22CDD3C1-E729-449A-A77B-4D7381565632.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS28637644-7B98-44A5-BAD8-2D6F1D2B59E3.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS291D2184-D28D-4E6F-A892-3BE69886A2EF.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS2B6093AD-43FA-4FDF-87AC-8ED83BA7B3C8.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS2C2958C4-3875-4275-AE6A-AFC28640DBA8.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS3225A465-2F8A-4ACA-AEE9-A62A13EDB122.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS34DC5B2F-07CE-41FA-8A55-0A6B9D7D4749.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS34D841AC-A726-405C-A19B-3D56B6797CE2.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS38C46E6F-F28F-4E63-AD69-CB8323C0198B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS3855D9B5-EBAF-4BA3-89C0-50B1E551FBD0.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS3DFBDEDB-4048-4A7E-A09F-3011675C548F.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS3DE808B4-33E8-4A1A-822A-12771A92548C.tmp" Wed 5 Nov 2008 65,536 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS3E1C8421-BA4C-4180-ABB6-1B17429A374B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS40E47279-AC2E-4C4A-B0C6-3EC102B18EF9.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS48C924C0-5978-4076-B942-0B7681FBA206.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS5094812B-1473-4F60-B512-150F683B7CC1.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS53267BF2-DD44-4D55-AA51-D87B9FE139D6.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS55C1AF18-7340-40D0-B8C8-50FF4C978FF1.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS59793B40-6957-4B38-B4DE-1E3854E918A0.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS5B581E9A-E6B2-4A50-9568-63B9B4066117.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS5C836835-56CA-480A-B498-1EE48BAA9085.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS5F099E45-9F88-48CC-B469-503BE0CCA4B0.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS5FE0FA86-B80D-4723-BEED-7E1902A22343.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS5F1AE412-0087-4FC9-AB93-AB204A3D5367.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS62A4640D-361F-44CE-BBF2-AB743FD99FD1.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS62B31273-6BF9-4076-9708-09E2E6E4DE9C.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS65B51252-2321-4D2B-B564-58636ED14169.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS71622B37-3321-46A9-A1C9-DDD604655B75.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS722074D2-68BB-46F1-A8B9-69E7FEFED59D.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS72FE9D07-25D2-4187-8D8F-6B969AE2A941.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS73A1BD8A-7DA3-4A15-9092-C7D5ADE26DCF.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS73E13505-4DA7-46F1-91C6-DB3DA98C8BFA.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS7A53BA23-65B0-4D6F-AF78-4A09583A25C8.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS7DD562BC-172B-498F-BD9C-F11B3C9D878B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS7E10CF1A-EEBC-48AB-AD35-12560430CB92.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS81B5EECE-4100-441A-B359-A9FDACFFDBB5.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS8480B381-9B1D-4B2E-B810-DC63790320F2.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS8494B6CF-B6EF-40D4-84D5-7B4CF1410270.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS8AAFFA5F-BBAD-4060-B96A-F2F7D3711EF5.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS8AEA6BC2-C7E9-4D3D-B0C4-EEF3C575CE48.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS8D5E6851-881F-4833-8D52-C264CCE29F0B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS8FB1C015-15D6-41A7-9FB5-C4226D8920B6.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS8F2BF021-9123-4A86-82BF-828775AA3A0C.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMS980A2449-C556-4028-8290-9677341F1538.tmp" Wed 5 Nov 2008 65,536 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSA0585373-0B8C-4320-91C7-C4EC492BE821.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSA1D71DBB-6BEC-4829-96AB-D1C453ACB562.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSA587535F-9011-4103-A5A4-61D171DB7442.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSA69078EC-5192-492D-8BD5-E1AF473CFE74.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSAC479ECB-1F44-41FB-B0DD-C3FBE810D739.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSAE5F47D8-99CC-4910-99E4-2AD827B64C0A.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSAFC72831-1B78-4FA7-9010-3C545F662A17.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSB3457843-F083-423D-A1E0-972766D092E7.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSB3D82903-EF90-44E8-BB33-7256D067EFC5.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSB5BE1217-2D3A-4F14-82E7-90AC63672AA0.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSB5768145-4751-4459-98A5-C0A74D29C343.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSB5629915-49F2-4FB5-9608-C4097C08BC56.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSB8799667-9CD8-45D8-AF95-1E3720494A6B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSB91E255D-B324-4A3F-AE04-0CDE655A831D.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSBA50EFBB-6F1F-40D1-AA92-C1CF70A9D1B6.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSBF329435-5A30-4E9B-8C90-B623C2E3A872.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSC2C408BA-4B13-417F-B951-F4F6C601A672.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSC3ED37C4-3C35-4ACF-8DCF-EF1C6490291B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSC39A34BC-EEAC-46EA-A013-13E14C980183.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSC946F937-C5F5-4794-A43F-8656163B17CA.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSC94BEC6F-1779-4EF4-ACDA-DE2E0FB027C1.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSC999E9D6-1F1A-4462-BE71-4B38E642EA9F.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSCBCBACAC-F75F-484E-904C-E3FCD9B2BBDF.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSCF8BA851-0E9A-4EB5-85D0-CA82CB8A372B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSD077751F-A962-4A0F-BD7E-738F180059C7.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSD4FE4D60-0DB2-404C-A436-2066A7729295.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSD5A8CEB4-BAF2-40F5-AE73-BF1CEF6DAB6F.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSD67D40CF-4933-4B63-ADA3-792729A40629.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSD8069DA5-49FA-4E01-A17F-DC755A528ED6.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSD865305A-EFB7-4890-8AF4-0AA0DE430664.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSDA61B9F2-8FF9-4A3A-864D-ED4339F53679.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSDC62F9AD-9101-4D32-81BA-949EF33792B9.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSE1AFBD4B-B0CD-483F-B6E0-1FA72CDF218E.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSE49BCA5D-7549-4232-8CB8-B4D3E3B7EBC5.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSE66C99A4-FCCF-4825-8570-1DD738A73292.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSE89C1F7D-1BC1-4F70-997B-F5B18865EE2E.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSEC856642-3050-4D74-8C08-00DED9950A3C.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSEDD44F9C-D22C-41E4-A929-DF373C0B782E.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSF0106546-3B53-45C4-8CF6-4A3416A59A6B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSF25928E6-E906-444F-BB60-504D20408376.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSF341699A-FCE6-48D9-B027-E81CEDB13E3B.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSF35C9302-E23A-4103-9442-9BA7D41F4D54.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSF5A75A36-9191-4424-BE06-435AF0A06E5D.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSF5CEEE99-AFBB-4A50-9AB5-410BDB243532.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSF66A8076-E694-4950-B4DF-30A6D4E49852.tmp" Wed 5 Nov 2008 0 A..H. --- "C:\WINDOWS\Temp\wrstemp\SSMSFC3542C6-D176-4994-BF85-C7DD3A78B5DF.tmp" Sun 17 Jun 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Tue 12 Apr 2005 95,892 ...H. --- "C:\Program Files\Comcast\Comcast PhotoShow 4\data\Comcast PhotoShow Deluxe.exe" Tue 5 Aug 2008 1,368 A..H. --- "C:\Program Files\Common Files\AOL\IPHSend\IPH.BAK" Wed 13 Feb 2008 29,696 A..H. --- "C:\Documents and Settings\Sorber\Desktop\Heather is so fly!\My Documents\~WRL0373.tmp" Wed 13 Feb 2008 30,208 A..H. --- "C:\Documents and Settings\Sorber\Desktop\Heather is so fly!\My Documents\~WRL1652.tmp" Thu 13 Sep 2007 27,136 A..H. --- "C:\Documents and Settings\Sorber\Desktop\Heather is so fly!\My Documents\~WRL3578.tmp" [b]Finished![/b]

Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your McAfee antivirus, Spy Sweeper and any other antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

ComboFix 08-11-05.02 - Sorber 2008-11-06 9:23:03.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.427 [GMT -5:00] Running from: c:\documents and settings\Sorber\Desktop\ComboFix.exe * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Common\helper.sig c:\windows\setup.exe c:\windows\system32\_000006_.tmp.dll c:\windows\system32\_000009_.tmp.dll . ((((((((((((((((((((((((( Files Created from 2008-10-06 to 2008-11-06 ))))))))))))))))))))))))))))))) . 2008-11-05 07:22 . 2008-11-05 07:21 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-05 07:22 . 2008-11-05 07:21 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-04 19:51 . 2008-11-04 19:51 <DIR> d-------- c:\documents and settings\Sorber\Application Data\Viewpoint 2008-11-04 01:42 . 2008-11-04 01:42 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-04 01:42 . 2008-11-04 01:42 <DIR> d-------- c:\documents and settings\Sorber\Application Data\Malwarebytes 2008-11-04 01:42 . 2008-11-04 01:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-04 01:42 . 2008-10-22 16:28 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-04 01:42 . 2008-10-22 16:28 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-03 21:39 . 2008-11-03 21:39 <DIR> d-------- c:\documents and settings\Sorber\Application Data\Template 2008-11-03 21:39 . 2008-11-05 06:59 252 --a------ c:\documents and settings\Sorber\Application Data\wklnhst.dat 2008-11-03 20:20 . 2008-11-03 20:20 <DIR> d-------- c:\documents and settings\Sorber\Application Data\Comcast 2008-11-03 12:26 . 2008-11-03 12:26 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-11-03 12:15 . 2008-11-03 12:16 <DIR> d-------- c:\windows\ERUNT 2008-11-03 00:38 . 2008-11-03 00:38 <DIR> d-------- c:\program files\iTunes 2008-11-03 00:38 . 2008-11-03 00:38 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-02 23:56 . 2008-11-02 23:57 <DIR> d-------- c:\program files\Safari 2008-11-02 21:23 . 2008-11-02 21:23 <DIR> d-------- c:\documents and settings\Sorber\Application Data\acccore 2008-11-01 16:14 . 2008-11-01 16:14 1,409 --a------ c:\windows\system32\tmp62107.FOT 2008-11-01 16:14 . 2008-11-01 16:14 1,409 --a------ c:\windows\system32\tmp49107.FOT 2008-11-01 16:14 . 2008-11-01 16:14 1,409 --a------ c:\windows\system32\tmp40FF6.FOT 2008-11-01 16:14 . 2008-11-01 16:14 1,409 --a------ c:\windows\system32\tmp2E107.FOT 2008-11-01 16:14 . 2008-11-01 16:14 1,409 --a------ c:\windows\system32\tmp02207.FOT 2008-10-31 10:42 . 2008-10-31 10:42 2 --a------ c:\windows\msoffice.ini 2008-10-27 09:45 . 2008-10-27 14:08 <DIR> d-------- c:\documents and settings\Sorber\Application Data\Babylon 2008-10-24 09:26 . 2008-10-15 11:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-22 14:55 . 2008-10-22 14:55 1,409 --a------ c:\windows\system32\tmpC802D.FOT 2008-10-22 14:55 . 2008-10-22 14:55 1,409 --a------ c:\windows\system32\tmp9C32D.FOT 2008-10-22 14:55 . 2008-10-22 14:55 1,409 --a------ c:\windows\system32\tmp8312D.FOT 2008-10-22 14:55 . 2008-10-22 14:55 1,409 --a------ c:\windows\system32\tmp7DE1D.FOT 2008-10-22 14:55 . 2008-10-22 14:55 1,409 --a------ c:\windows\system32\tmp4942D.FOT 2008-10-21 16:44 . 2008-10-21 16:44 1,409 --a------ c:\windows\system32\tmpFC3C9.FOT 2008-10-21 16:44 . 2008-10-21 16:44 1,409 --a------ c:\windows\system32\tmpD81C9.FOT 2008-10-21 16:44 . 2008-10-21 16:44 1,409 --a------ c:\windows\system32\tmp7FFB9.FOT 2008-10-21 16:44 . 2008-10-21 16:44 1,409 --a------ c:\windows\system32\tmp5ADB9.FOT 2008-10-21 16:44 . 2008-10-21 16:44 1,409 --a------ c:\windows\system32\tmp485C9.FOT 2008-10-17 21:19 . 2008-10-17 21:19 1,409 --a------ c:\windows\system32\tmp8D0F7.FOT 2008-10-17 21:19 . 2008-10-17 21:19 1,409 --a------ c:\windows\system32\tmp89BE7.FOT 2008-10-17 21:19 . 2008-10-17 21:19 1,409 --a------ c:\windows\system32\tmp856E7.FOT 2008-10-17 21:19 . 2008-10-17 21:19 1,409 --a------ c:\windows\system32\tmp23FE7.FOT 2008-10-17 21:19 . 2008-10-17 21:19 1,409 --a------ c:\windows\system32\tmp04AE7.FOT 2008-10-17 17:08 . 2008-10-17 17:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\Webroot 2008-10-17 17:08 . 2008-10-12 12:18 1,553,272 --a------ c:\windows\WRSetup.dll 2008-10-17 17:07 . 2008-10-17 17:07 <DIR> d-------- c:\program files\Webroot 2008-10-17 17:07 . 2008-10-17 17:07 <DIR> d-------- c:\program files\AskSBar 2008-10-17 17:03 . 2008-10-17 17:03 164 --a------ C:\install.dat 2008-10-16 16:39 . 2008-10-16 16:39 <DIR> d-------- c:\documents and settings\Sorber\Application Data\Webroot 2008-10-16 16:27 . 2008-09-08 05:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-10-16 16:25 . 2008-08-14 05:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-16 16:25 . 2008-08-14 05:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-16 16:25 . 2008-08-14 04:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-16 16:25 . 2008-08-14 04:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-10-16 16:25 . 2008-09-15 07:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-06 14:23 --------- d-----w c:\program files\Common 2008-11-06 05:12 --------- d-----w c:\documents and settings\Sorber\Application Data\ComcastToolbar 2008-11-05 12:21 --------- d-----w c:\program files\Java 2008-11-03 20:21 --------- d-----w c:\program files\Limewire Pro 2008-11-03 18:02 --------- d-----w c:\program files\Trend Micro 2008-11-03 14:36 --------- d--h--w c:\documents and settings\Sorber\Application Data\Move Networks 2008-11-03 13:53 --------- d-----w c:\program files\Apple Software Update 2008-11-03 05:38 --------- d-----w c:\program files\iPod 2008-10-31 20:21 --------- d-----w c:\program files\Bonjour 2008-10-31 17:50 --------- d-----w c:\program files\Google 2008-10-31 15:47 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-31 15:47 --------- d-----w c:\documents and settings\All Users\Application Data\Napster 2008-10-31 15:43 --------- d-----w c:\program files\Common Files\AOL 2008-10-29 16:41 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-10-22 00:51 --------- d-----w c:\program files\Microsoft SQL Server 2008-10-02 08:15 29,808 ----a-w c:\windows\system32\drivers\ssfs0bbc.sys 2008-10-02 08:15 23,152 ----a-w c:\windows\system32\drivers\sshrmd.sys 2008-10-02 08:15 170,608 ----a-w c:\windows\system32\drivers\ssidrv.sys 2008-09-17 16:56 --------- d-----w c:\program files\McAfee 2008-09-14 16:49 --------- d-----w c:\program files\QuickTime 2008-09-14 16:48 --------- d-----w c:\program files\Common Files\Apple 2008-09-08 10:41 333,824 ----a-w c:\windows\system32\drivers\srv.sys 2008-03-17 11:59 356,352 ----a-w c:\documents and settings\Sorber\cwshredder.dll 2005-01-07 19:20 278,528 ----a-w c:\program files\internet explorer\plugins\PanoViewer.dll 2005-01-07 19:20 143,360 ----a-w c:\program files\internet explorer\plugins\UPjpeg.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-10-17 66912] [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}] 2008-04-17 02:42 398768 --a------ c:\program files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 81920] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-01-03 50528] "Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-04-01 3587120] "PhotoShow Deluxe Media Manager"="c:\progra~1\Comcast\COMCAS~1\data\xtras\mssysmgr.exe" [2005-05-09 192512] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-17 118784] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-04-05 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-04-05 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-04-05 118784] "VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 28672] "SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-27 217088] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768] "VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-11 151552] "Mouse Suite 98 Daemon"="c:\windows\system32\ICO.exe" [2002-03-14 45056] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-08 7561216] "Switcher.exe"="c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128] "VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632] "ViewMgr"="c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-10 111816] "ViewpointPhotosDeviceConnect"="c:\program files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\FotomatDeviceConnect.exe" [2006-11-01 145072] "nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2007-05-21 321088] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2005-10-28 335872] "HostManager"="c:\program files\Common Files\AOL\1154548953\ee\AOLSoftware.exe" [2007-05-25 42032] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 188416] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 233472] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152] "DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-05 136600] "SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2008-10-12 6272888] c:\documents and settings\All Users\Start Menu\Programs\Startup\ MiniEYE-MiniREAD Launch.lnk - c:\program files\Infinite Mind LC\eyeQ\ARLaunch.exe [2007-06-25 323584] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= c:\windows\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= c:\windows\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2006-03-09 16:51 73728 c:\windows\system32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=ebdtbw.dll inlulu.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfehidk.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mferkdk.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1154548953\\ee\\aolsoftware.exe"= "c:\\Program Files\\Limewire Pro\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.exe"= "c:\\Program Files\\Common Files\\AOL\\acs\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\acs\\AOLacsd.exe"= "c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "67:UDP"= 67:UDP:DHCP Discovery Service R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\DRIVERS\ssfs0bbc.sys [2008-10-02 29808] R2 JavaQuickStarterService;Java Quick Starter;c:\program files\Java\jre6\bin\jqs.exe [2008-11-05 152984] R2 litsgt;litsgt;c:\windows\system32\DRIVERS\litsgt.sys [2007-06-25 137344] R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 7520337] R2 tansgt;tansgt;c:\windows\system32\DRIVERS\tansgt.sys [2007-06-25 12032] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652] R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2008-10-12 1066360] R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2006-03-06 30080] R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-02-21 226304] S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\Sony\Image Converter 2\IcVzMon.exe [2005-07-14 32768] S3 pelmouse;Mouse Suite Driver;c:\windows\system32\DRIVERS\pelmouse.sys [2002-06-28 17251] S3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\DRIVERS\pelusblf.sys [2001-07-24 7520] S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.exe [2002-12-17 311872] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95734ff8-54c2-11db-aa33-0018de087897}] \Shell\AutoRun\command - G:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95734ff9-54c2-11db-aa33-0018de087897}] \Shell\AutoRun\command - H:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8435c48-225e-11db-b383-806d6172696f}] \Shell\AutoRun\command - e:\sony\Autorun.exe . Contents of the 'Scheduled Tasks' folder 2008-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2008-08-15 c:\windows\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32] 2008-11-01 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32] 2008-11-06 c:\windows\Tasks\wrSpySweeper_L39C7B03C7AAD42618AD2A9E2CF00B147.job - c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe [2008-10-12 12:18] 2008-11-06 c:\windows\Tasks\wrSpySweeper_L39C7B03C7AAD42618AD2A9E2CF00B147.job - c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe [2008-10-12 12:18] 2008-11-06 c:\windows\Tasks\wrSpySweeper_L39C7B03C7AAD42618AD2A9E2CF00B147.job - c:\","d:\","e:\","f:\" [] . - - - - ORPHANS REMOVED - - - - BHO-{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file) BHO-{1CAD29DF-1D6D-41A2-8C55-EAA2C7EDCDEB} - c:\windows\msagent\chars\fastnati.dll HKCU-Run-AIM - c:\program files\AIM\aim.exe Notify-fastnati - c:\windows\msagent\chars\fastnati.dll SafeBoot-mfehidk SafeBoot-mferkdk SafeBoot-mfetdik SafeBoot-mfetdik.sys . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.sony.com/vaiopeople R0 -: HKCU-Main,Search Bar = hxxp://www.comcast.net/toolbar2.0/search/ R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeople R0 -: HKLM-Search,SearchAssistant = hxxp://www.comcast.net/toolbar2.0/search/ O8 -: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html O8 -: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000 O8 -: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-06 09:31:26 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Common Files\AOL\acs\AOLacsd.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\ehome\ehrecvr.exe c:\windows\ehome\ehSched.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\Common Files\McAfee\MNA\McNASvc.exe c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe c:\program files\McAfee\MPF\MpfSrv.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\program files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe c:\program files\Sony\VAIO Event Service\VESMgr.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe c:\program files\Webroot\WebrootSecurity\SpySweeper.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\igfxext.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\igfxsrvc.exe c:\program files\Pure Networks\Network Magic\nmsrvc.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe c:\windows\system32\dllhost.exe c:\windows\ehome\ehmsas.exe c:\program files\Apoint\ApntEx.exe c:\program files\iPod\bin\iPodService.exe c:\program files\AIM6\aolsoftware.exe c:\progra~1\McAfee\MSC\mcuimgr.exe c:\program files\Webroot\WebrootSecurity\SSU.exe c:\windows\system32\imapi.exe . ************************************************************************** . Completion time: 2008-11-06 9:41:20 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-06 14:41:09 Pre-Run: 83,275,874,304 bytes free Post-Run: 83,364,585,472 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 298 --- E O F --- 2008-10-24 14:39:10