Please download Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. Save it to your desktop. Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\system32\ggqbokxa.dll C:\WINDOWS\system32\tcxbqecu.exe C:\WINDOWS\system32\ojtabulb.exe C:\WINDOWS\system32\lvlhipvv.exe C:\WINDOWS\system32\oijbwgge.exe C:\WINDOWS\system32\omiusqbe.exe C:\WINDOWS\system32\itjuetnj.exe C:\WINDOWS\system32\bmclbjxk.exe C:\WINDOWS\system32\svxgmeha.exe C:\WINDOWS\system32\foqvwbbk.exe Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again. Please post a new Hijack This log and a new combofix log. Then we will need a few more tools. Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install Ewido Security Suite We will need this later in safe mode Be sure to update Ewido

0

Logfile of HijackThis v1.99.1 Scan saved at 7:51:29 PM, on 10/6/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe c:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe c:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\DIGStream\digstream.exe C:\Program Files\ESPNRunTime\DIGServices.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\AOL\1125116353\ee\AOLHostManager.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe C:\Program Files\Common Files\AOL\1125116353\ee\AOLServiceHost.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Ryan\Desktop\show.exe.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINDOWS\system32\ggqbokxa.dll (file missing) O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {E50AF7B3-C664-419C-A82B-AD3C04AAE34C} - C:\WINDOWS\addins\datuil.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1125116353\ee\AOLHostManager.exe O4 - HKLM\..\Run: [Adobe Version Cue CS2] "c:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SysProtect] C:\Program Files\SysProtect Free\USYP.exe /scan O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/open... (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O15 - Trusted Zone: http://locator.cdn.imageservr.com O15 - Trusted Zone: http://learn.vt.edu O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c... O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Unknown owner - c:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe Ryan - 06-10-06 19:52:15.78 Service Pack 2 ComboFix 06.09.28 - Running from: "C:\Documents and Settings\Ryan\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-09-06 to 2006-10-06 )))))))))))))))))))))))))))))))))) 2006-10-06 02:08 53,248 --a------ C:\WINDOWS\system32\Process.exe 2006-10-06 02:08 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-10-06 02:08 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-10-06 02:08 135,168 --a------ C:\WINDOWS\system32\swreg.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-06 19:50 -------- d-------- C:\Program Files\Mozilla Firefox 2006-10-06 19:49 -------- d-------- C:\Documents and Settings\Ryan\Application Data\AdobeUM 2006-10-06 19:45 -------- d-------- C:\Program Files\Symantec AntiVirus 2006-10-06 10:35 -------- d-------- C:\Program Files\Hijackthis 2006-10-05 01:51 -------- d-------- C:\Program Files\Dl_cats 2006-10-04 20:30 -------- d-------- C:\Program Files\Trillian 2006-10-04 20:28 -------- d-------- C:\Program Files\DivX 2006-09-29 01:42 -------- d-------- C:\Program Files\VSToolbar 2006-09-26 16:26 -------- d-------- C:\Program Files\AIM 2006-09-26 16:25 -------- d-------- C:\Program Files\AOD 2006-09-26 02:49 -------- d-------- C:\Documents and Settings\Ryan\Application Data\SearchToolbarCorp 2006-08-21 08:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 05:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-21 05:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-08-19 02:17 -------- d-------- C:\Program Files\Common Files 2006-08-09 23:02 -------- d-------- C:\Program Files\Internet Explorer 2006-07-27 09:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "SysProtect"="C:\\Program Files\\SysProtect Free\\USYP.exe /scan" "updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /installquiet" "SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe" "Apoint"="C:\\Program Files\\Apoint\\Apoint.exe" @="" "IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless" "PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\"" "Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe" "DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\"" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "mmtask"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mmtask.exe" "RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe" "Dell Photo AIO Printer 922"="\"C:\\Program Files\\Dell Photo AIO Printer 922\\dlbtbmgr.exe\"" "DLBTCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\DLBTtime.dll,_RunDLLEntry@16" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1125116353\\ee\\AOLHostManager.exe" "Adobe Version Cue CS2"="\"c:\\Program Files\\Adobe\\Adobe Version Cue CS2\\ControlPanel\\VersionCueCS2Tray.exe\"" "Acrobat Assistant 7.0"="\"C:\\Program Files\\Adobe\\Adobe Acrobat 7.0\\Distillr\\Acrotray.exe\"" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe" "DIGServices"="C:\\Program Files\\ESPNRunTime\\DIGServices.exe /brand=ESPN /priority=0 /poll=24" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,80,01,00,00,00,00,00,00,00,06,00,00,8e,04,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Completion time: Fri 10/06/2006 19:53:23.87 ComboFix.txt ComboFix2.txt ComboFix3.txt

0

Much better, you have a newer mutation of Vundo that the fixtool would not remove. Appears we got it. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINDOWS\system32\ggqbokxa.dll (file missing) O2 - BHO: (no name) - {E50AF7B3-C664-419C-A82B-AD3C04AAE34C} - C:\WINDOWS\addins\datuil.dll (file missing) O4 - HKCU\..\Run: [SysProtect] C:\Program Files\SysProtect Free\USYP.exe /scan O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O15 - Trusted Zone: http://locator.cdn.imageservr.com O15 - Trusted Zone: http://learn.vt.edu Exit Hijack This but remain in safe mode Navigate to and delete this file: C:\Program Files\SysProtect Free\USYP.exe Navigate to and delete these folders: C:\Program Files\VSToolbar C:\Documents and Settings\Ryan\Application Data\SearchToolbarCorp C:\Program Files\SysProtect Free C:\Program Files\AWS Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run Ewido and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Post the Ewido report on your desktop and a new Hijack This log.

0

The only task I was unable to complete was removing the file: C:\Program Files\SysProtect Free\USYP.exe as well as the folder: C:\Program Files\SysProtect Free I could not find them - but here are the logs for the other steps: Logfile of HijackThis v1.99.1 Scan saved at 10:35:40 PM, on 10/6/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.exe C:\Documents and Settings\Ryan\Desktop\show.exe.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINDOWS\system32\ggqbokxa.dll (file missing) O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {E50AF7B3-C664-419C-A82B-AD3C04AAE34C} - C:\WINDOWS\addins\datuil.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1125116353\ee\AOLHostManager.exe O4 - HKLM\..\Run: [Adobe Version Cue CS2] "c:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SysProtect] C:\Program Files\SysProtect Free\USYP.exe /scan O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/open... (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O15 - Trusted Zone: http://locator.cdn.imageservr.com O15 - Trusted Zone: http://learn.vt.edu O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c... O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Unknown owner - c:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe AVG Anti-Spyware - Scan Report + Created at: 2:19:51 AM 10/7/2006 + Scan result: C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP449\A0035481.dll -> Adware.Aws : Cleaned with backup (quarantined). C:\VundoFix Backups\mendkutw.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\nhmrhsty.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\nqftcuui.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\siqtjqth.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\qrdehdak.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined). C:\VundoFix Backups\utqbegih.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined). C:\VundoFix Backups\vyhkovaa.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned with backup (quarantined). C:\!KillBox\bmclbjxk.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). C:\!KillBox\foqvwbbk.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). C:\!KillBox\itjuetnj.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). C:\!KillBox\lvlhipvv.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). C:\!KillBox\oijbwgge.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). C:\!KillBox\ojtabulb.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). C:\!KillBox\omiusqbe.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). C:\!KillBox\svxgmeha.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). C:\!KillBox\tcxbqecu.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned with backup (quarantined). :mozilla.195:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.196:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.197:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.198:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.199:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.200:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.201:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.202:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.203:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.204:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.205:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.206:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.441:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.651:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.653:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.312:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.313:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.316:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.538:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.539:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.540:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.541:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.542:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.543:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.544:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.545:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.602:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.603:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.42:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.44:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.45:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.46:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.47:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.48:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.49:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.43:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.491:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.442:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned. :mozilla.733:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.734:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.735:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.515:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned. :mozilla.300:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.309:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.310:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.81:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.82:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.83:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.84:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.85:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.86:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.87:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.88:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.89:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.90:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.546:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Centrport : Cleaned. :mozilla.321:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.268:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned. :mozilla.625:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.626:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.627:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.628:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.17:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.20:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.21:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.31:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.430:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.235:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.236:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.237:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.238:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.239:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.112:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.117:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.101:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.102:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.103:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.104:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.606:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Findwhat : Cleaned. :mozilla.946:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Goclick : Cleaned. :mozilla.947:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Goclick : Cleaned. :mozilla.522:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.389:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.390:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.391:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.478:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.479:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.480:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.481:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.483:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.484:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.485:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.767:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.939:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.331:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned. :mozilla.685:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned. :mozilla.342:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.343:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.344:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.932:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned. :mozilla.32:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.33:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.818:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.819:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.247:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.248:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.249:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.346:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.69:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.70:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.71:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.72:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.73:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.65:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.66:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.67:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.68:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.178:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.179:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.180:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.181:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.182:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.183:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.184:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.185:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.186:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.187:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.188:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.892:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.284:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.285:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.286:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.287:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.362:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.363:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.364:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.365:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.366:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.923:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.924:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.925:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.926:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.927:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.928:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.930:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned. :mozilla.931:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned. :mozilla.463:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.464:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.465:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.466:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.836:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Spylog : Cleaned. :mozilla.672:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.673:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.674:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.675:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.676:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.677:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.678:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.308:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.311:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.314:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.315:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.536:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.866:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned. :mozilla.867:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned. :mozilla.207:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.208:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.209:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.210:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.211:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.212:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.213:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.214:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.601:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Trafic : Cleaned. :mozilla.16:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.22:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.23:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.24:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.25:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.26:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.27:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.28:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.29:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.30:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.440:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned. :mozilla.804:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.805:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.806:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.807:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.808:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.809:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.810:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.811:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.812:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.572:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.574:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.683:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Yadro : Cleaned. :mozilla.166:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.168:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.170:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.172:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.173:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.467:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.468:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.469:C:\Documents and Settings\Ryan\Application Data\Mozilla\Firefox\Profiles\vtmbri0i.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. C:\VundoFix Backups\vnplcwrw.exe.bad -> Trojan.Small.ju : Cleaned with backup (quarantined). ::Report end

0

Please download Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. Save it to your desktop. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\Program Files\SysProtect Free\USYP.exe C:\Program Files\SysProtect Free\ Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again. Please download WinHelp2002's DelDomains by right-clicking on the following link, and choosing "Save Target As": http://www.mvps.org/winhelp2002/DelDomains.inf Save the file to the desktop. Then go to the desktop, right click on DelDomains.inf, and choose Install. You may not see any noticeable changes or prompts; this is normal. Then please restart your computer. Post a new Hijack This log please.

0

I received a PendingFileRenameOperations prompt when running killbox removals! Logfile of HijackThis v1.99.1 Scan saved at 4:11:08 AM, on 10/8/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\AOL\1125116353\ee\AOLHostManager.exe C:\Program Files\DIGStream\digstream.exe C:\Program Files\Symantec AntiVirus\DoScan.exe C:\Program Files\ESPNRunTime\DIGServices.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Common Files\AOL\1125116353\ee\AOLServiceHost.exe c:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe c:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Ryan\Desktop\show.exe.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1125116353\ee\AOLHostManager.exe O4 - HKLM\..\Run: [Adobe Version Cue CS2] "c:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/open... (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c... O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Unknown owner - c:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

0

Your Hijack This log is clean. Are you running better now? You java is out of date and is most likely the reason you were infected with Vundo. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_5_0_09-windowsi586-p.exe to install the newest version. You should add "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0

I apologize for the delayed response! It definitely is running better now, and I thank you for all the assistance you have given - I'd be lost otherwise. Of all the tools we have used, are there any that I can remove at this point? Or are these all things I need to hang on to?

0

You can uninstall Hijack This and Ewido via add/remove progams. Then delete the others...vundofix, killbox, combofix from the desktop. Ewido is a good tool and will continue to update pasts it trial period (I think it still does) and ATF-Cleaner you should keep and run every two weeks. Glad we could help.

0