Hi, Can someone help with this virus? My updated AVG scanner keeps finding this trojan in c:\windows\system\f?nts or c:\windows\system32\f?nts It keeps saying it has deleted it, but it still keeps finding it on every scan. Neill

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop. Doubleclick on the HJTsetup.exe icon on your desktop. By default it will install to C:\Program Files\Hijack This. Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue. Put a check by "Create a desktop icon" then click "Next" again. Continue to follow the rest of the prompts from there. At the final dialogue box click "Finish" and it will launch Hijack This. Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread. Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly. Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/ComboFix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log it produces.

Wow! Thanks for the prompt reply. Here is the Hijack this log: Logfile of HijackThis v1.99.1 Scan saved at 12:42:13 PM, on 6/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\System32\cisvc.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/35... O17 - HKLM\System\CCS\Services\Tcpip\..\{5217BFD6-5177-45CA-A354-3A1B5E2D8F44}: NameServer = 203.194.27.57 203.194.56.150 O20 - Winlogon Notify: App Paths - C:\WINDOWS\system32\ehs.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) Here is the combofix log: "Neill F. Levine" - 07-04-06 12:47:49 Service Pack 2 ComboFix 07-04-05 - Running from: "C:\Documents and Settings\Neill F. Levine\Desktop" ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) REGISTRY ENTRIES REMOVED: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\clsid\{526a552e-f1ed-4f29-8183-32390f667093}] @="" [HKEY_CLASSES_ROOT\clsid\{526a552e-f1ed-4f29-8183-32390f667093}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\clsid\{526a552e-f1ed-4f29-8183-32390f667093}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\clsid\{526a552e-f1ed-4f29-8183-32390f667093}\InprocServer32] @="C:\\WINDOWS\\system32\\ehs.dll" "ThreadingModel"="Apartment" * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Granting SeDebugPrivilege to Administrators ... successful (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\keyboard91.dat C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com C:\Program Files\winupdates ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\WINDOWS\system32\FNTS~1 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts C:\qoobox\purity\WINDOWS\system32\FNTS~1\winlogon.exe C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0000 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0001 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0002 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0003 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0004 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0005 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0006 ((((((((((((((((((((((((((((((( Files Created from 2007-03-06 to 2007-04-06 )))))))))))))))))))))))))))))))))) 2007-03-20 20:22 85,504 --a------ C:\WINDOWS\system32\encdnet.dll 2007-03-20 20:22 81,920 --a------ C:\WINDOWS\system32\ra3214_4.dll 2007-03-20 20:22 61,440 --a------ C:\WINDOWS\system32\decdnet.dll 2007-03-20 20:22 14,848 --a------ C:\WINDOWS\system32\ra32dnet.dll 2007-03-20 20:20 266,752 --a------ C:\WINDOWS\system32\xaudio.dll 2007-03-20 20:20 <DIR> d-------- C:\Program Files\Carrot 2007-03-20 20:08 48,640 --a------ C:\WINDOWS\system32\INETWH32.DLL 2007-03-20 20:08 4,528 --a------ C:\WINDOWS\system32\SETBROWS.exe 2007-03-20 20:08 <DIR> d-------- C:\WINDOWS\Ulead.dat 2007-03-20 19:49 <DIR> d-------- C:\WINDOWS\system32\Adobe 2007-03-19 18:18 <DIR> d-------- C:\DOCUME~1\NEILLF~1.LEV\.csi 2007-03-19 18:15 <DIR> d-------- C:\Program Files\CSI 2007-03-16 15:07 127,208 --a------ C:\WINDOWS\system32\mucltui.dll 2007-03-12 16:04 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-03-12 16:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-03-20 20:25 -------- d-------- C:\Program Files\hammerhead 2007-03-20 20:17 -------- d-------- C:\Program Files\vstplugins 2007-03-20 20:08 -------- d-------- C:\Program Files\ulead systems 2007-03-20 19:20 -------- d-------- C:\Program Files\quicktime 2007-03-19 17:34 -------- d-------- C:\Program Files\java 2007-03-16 14:39 -------- d-------- C:\DOCUME~1\NEILLF~1.LEV\APPLIC~1\limewire (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.exe " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="avgcc" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ipoint" "hkey"="HKLM" "command"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ADGJDet" "hkey"="HKLM" "command"="\"C:\\Program Files\\Creative\\SBLive\\PROGRAM\\ADGJDet.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="nod32kui" "hkey"="HKLM" "command"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PE2CKFNT SE] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ChkFont" "hkey"="HKLM" "command"="C:\\Program Files\\Ulead Systems\\Ulead Photo Express 2 SE\\ChkFont.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AdobeUpdateManager" "hkey"="HKCU" "command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="UpdReg" "hkey"="HKLM" "command"="C:\\WINDOWS\\UpdReg.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vsc32cnf.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="vsc32cnf" "hkey"="HKLM" "command"="C:\\Program Files\\Roland\\VSC32\\vsc32cnf.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vscvol.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="vscvol" "hkey"="HKLM" "command"="C:\\Program Files\\Roland\\VSC32\\vscvol.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CTHELPER" "hkey"="HKLM" "command"="CTHELPER.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="winupdates" "hkey"="HKLM" "command"="C:\\Program Files\\winupdates\\winupdates.exe /auto" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Avg7UpdSvc"=dword:00000002 "Avg7Alrt"=dword:00000002 "wuauserv"=dword:00000002 "wscsvc"=dword:00000002 "mnmsrvc"=dword:00000003 "AVGEMS"=dword:00000002 "ATI Smart"=dword:00000002 "Ati HotKey Poller"=dword:00000002 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoComputersNearMe"=hex:01,00,00,00 "NoLogoff"=dword:00000000 "NoRecentDocsMenu"=hex:01,00,00,00 "NoRecentDocsNetHood"=hex:01,00,00,00 "NoNetworkConnections"=hex:01,00,00,00 "NoWinKeys"=hex:01,00,00,00 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-06 12:53:06 C:\ComboFix-quarantined-files.txt ... 07-04-06 12:53

Go to start > controlpanel > add/remove programs and uninstall next if present: ClickSpring Cowabanga by OIN ipwindows / ipwins MediaTickets MediaTickets by OIN OIN Outer Info Network PurityScan PurityScan by OIN Snowball Wars by OIN TizzleTalk TizzleTalk by OIN Yazzle by OIN Yazzle ActiveX by OIN Yazzle Cowabanga by OIN Yazzle Kobe :filtered:! By OIN Yazzle Picster by OIN Yazzle Snowball Wars by OIN Yazzle Sudoku by OIN Zolero Translator or anything similar with Oin in it 888 toolbar anything with 888 in it If OIN not listed, download and run this uninstaller OiUninstaller.exe Reboot when done! Really important! Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode Be sure to update AVG Anti- Spyware Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": R3 - Default URLSearchHook is missing O20 - Winlogon Notify: App Paths - C:\WINDOWS\system32\ehs.dll (file missing) Exit Hijack This but remain in safe mode. Navigate to and delete this file if found: C:\WINDOWS\system32\ehs.dll Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Post the AVG report. Open notepad (Start Menu > Run > Type notepad and press "ok". Copy and paste everything into notepad between the x's making regedit4 the top line. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX REGEDIT4 [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop. Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes. You need to update your java as soon as possible. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version. Post a new hijack This log and a new combofix log> let us know how your computer is operating.

Here is the AVG report: AVG Anti-Spyware - Scan Report + Created at: 3:18:59 PM 6/04/2007 + Scan result: HKLM\SOFTWARE\Clickspring -> Adware.PurityScan : Cleaned with backup (quarantined). C:\QooBox\purity\WINDOWS\system32\FNTS~1\winlogon.exe -> Downloader.PurityScan.w : Cleaned with backup (quarantined). :mozilla.123:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.124:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.125:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.126:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.127:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.128:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.129:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.130:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.131:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.132:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.133:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.134:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.135:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.136:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.137:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.138:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.139:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.140:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.141:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.142:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.143:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.144:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.145:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.146:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.148:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.149:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.150:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.151:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.152:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.153:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.291:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.328:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.381:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.400:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.482:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.551:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.585:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.74:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.333:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.334:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.335:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.189:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.396:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.221:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.222:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.223:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.224:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.397:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Centrport : Cleaned. :mozilla.408:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.409:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.410:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.411:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.405:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.406:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.407:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.40:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.220:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.273:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.434:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.435:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.436:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.437:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.438:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.439:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.440:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.441:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.442:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.443:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.444:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.445:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.446:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.447:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.448:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.449:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.450:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.451:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.452:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.453:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.17:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.505:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned. :mozilla.755:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned. :mozilla.260:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.789:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.790:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.582:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.583:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.591:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.339:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.340:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.341:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.342:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.597:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned. :mozilla.599:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned. :mozilla.600:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned. :mozilla.601:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.602:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.225:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.455:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.183:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.184:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.185:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.186:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.187:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.188:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.285:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.286:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.287:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.288:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.497:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Starware : Cleaned. :mozilla.498:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Starware : Cleaned. :mozilla.803:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Starware : Cleaned. :mozilla.274:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.662:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.663:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.14:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.15:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.619:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.620:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.621:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.622:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.623:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.271:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.272:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.293:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.294:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.295:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.296:C:\Documents and Settings\Neill F. Levine\Application Data\Mozilla\Firefox\Profiles\ekkahhpb.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end

That was an involved afternoon. I hope it does the trick: Logfile of HijackThis v1.99.1 Scan saved at 5:13:53 PM, on 6/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\msiexec.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/35... O17 - HKLM\System\CCS\Services\Tcpip\..\{5217BFD6-5177-45CA-A354-3A1B5E2D8F44}: NameServer = 203.194.27.57 203.194.56.150 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) "Neill F. Levine" - 07-04-06 17:14:54 Service Pack 2 ComboFix 07-04-05 - Running from: "C:\Documents and Settings\Neill F. Levine\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\WINDOWS\system32\FNTS~1 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0000 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0001 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0002 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0003 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0004 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0005 C:\qoobox\purity\WINDOWS\system32\FNTS~1\F?nts\ctxad-426.0006 ((((((((((((((((((((((((((((((( Files Created from 2007-03-06 to 2007-04-06 )))))))))))))))))))))))))))))))))) 2007-04-06 17:09 <DIR> d-------- C:\Program Files\Common Files\Java 2007-04-06 14:07 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-03-20 20:22 85,504 --a------ C:\WINDOWS\system32\encdnet.dll 2007-03-20 20:22 81,920 --a------ C:\WINDOWS\system32\ra3214_4.dll 2007-03-20 20:22 61,440 --a------ C:\WINDOWS\system32\decdnet.dll 2007-03-20 20:22 14,848 --a------ C:\WINDOWS\system32\ra32dnet.dll 2007-03-20 20:20 266,752 --a------ C:\WINDOWS\system32\xaudio.dll 2007-03-20 20:20 <DIR> d-------- C:\Program Files\Carrot 2007-03-20 20:08 48,640 --a------ C:\WINDOWS\system32\INETWH32.DLL 2007-03-20 20:08 4,528 --a------ C:\WINDOWS\system32\SETBROWS.exe 2007-03-20 20:08 <DIR> d-------- C:\WINDOWS\Ulead.dat 2007-03-20 19:49 <DIR> d-------- C:\WINDOWS\system32\Adobe 2007-03-19 18:18 <DIR> d-------- C:\DOCUME~1\NEILLF~1.LEV\.csi 2007-03-19 18:15 <DIR> d-------- C:\Program Files\CSI 2007-03-16 15:07 127,208 --a------ C:\WINDOWS\system32\mucltui.dll 2007-03-12 16:04 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-03-12 16:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-06 17:10 -------- d-------- C:\Program Files\java 2007-03-20 20:25 -------- d-------- C:\Program Files\hammerhead 2007-03-20 20:17 -------- d-------- C:\Program Files\vstplugins 2007-03-20 20:08 -------- d-------- C:\Program Files\ulead systems 2007-03-20 19:20 -------- d-------- C:\Program Files\quicktime 2007-03-16 14:39 -------- d-------- C:\DOCUME~1\NEILLF~1.LEV\APPLIC~1\limewire (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.exe " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="avgcc" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ipoint" "hkey"="HKLM" "command"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ADGJDet" "hkey"="HKLM" "command"="\"C:\\Program Files\\Creative\\SBLive\\PROGRAM\\ADGJDet.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="nod32kui" "hkey"="HKLM" "command"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PE2CKFNT SE] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ChkFont" "hkey"="HKLM" "command"="C:\\Program Files\\Ulead Systems\\Ulead Photo Express 2 SE\\ChkFont.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AdobeUpdateManager" "hkey"="HKCU" "command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="UpdReg" "hkey"="HKLM" "command"="C:\\WINDOWS\\UpdReg.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vsc32cnf.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="vsc32cnf" "hkey"="HKLM" "command"="C:\\Program Files\\Roland\\VSC32\\vsc32cnf.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vscvol.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="vscvol" "hkey"="HKLM" "command"="C:\\Program Files\\Roland\\VSC32\\vscvol.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CTHELPER" "hkey"="HKLM" "command"="CTHELPER.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Avg7UpdSvc"=dword:00000002 "Avg7Alrt"=dword:00000002 "wuauserv"=dword:00000002 "wscsvc"=dword:00000002 "mnmsrvc"=dword:00000003 "AVGEMS"=dword:00000002 "ATI Smart"=dword:00000002 "Ati HotKey Poller"=dword:00000002 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoComputersNearMe"=hex:01,00,00,00 "NoLogoff"=dword:00000000 "NoRecentDocsMenu"=hex:01,00,00,00 "NoRecentDocsNetHood"=hex:01,00,00,00 "NoNetworkConnections"=hex:01,00,00,00 "NoWinKeys"=hex:01,00,00,00 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-06 17:17:57 C:\ComboFix-quarantined-files.txt ... 07-04-06 17:17 C:\ComboFix2.txt ... 07-04-06 12:53

A few questions: Can I delete that quarantine folder that was created? How can I prevent this from happening again? I am usually pretty diligent in scanning. I run the free AVG scanner for virus and Spybot and Lavasoft Adaware for spyware. What else do you recommend doing? I have a dialup connection. Neill