rond.starsdoor Pop Ups!

Hello turtle2953

Welcome to G2Go.
=================
The first thing I will need you to do is to Download this anti-virus program and install it.
This is free.
AVG free

======================
Please download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

I ran combofix and hijackthis again, here are the logs:

COMBOFIX:

ComboFix 08-02.03.1 - Brandy 2008-02-03 15:28:28.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.259 [GMT -7:00]
Running from: C:\Documents and Settings\Brandy\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\ophdnerm.ini

----- BITS: Possible infected sites -----

hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-02-03 14:29 . 2008-02-03 14:29 <DIR> d----c--- C:\Program Files\Trend Micro
2008-02-02 12:53 . 2008-02-02 12:53 <DIR> d----c--- C:\Program Files\MFInstall
2008-01-26 15:42 . 2008-01-26 15:43 <DIR> d----c--- C:\Program Files\Golden Hearts Juice Bar
2008-01-24 18:56 . 2008-01-24 18:56 125 --a--c--- C:\ioSpecial.ini
2008-01-23 20:26 . 2008-01-23 20:26 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-23 20:25 . 2008-01-24 20:17 <DIR> d----c--- C:\Program Files\SUPERAntiSpyware
2008-01-23 20:25 . 2008-01-23 20:25 <DIR> d----c--- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-23 20:25 . 2008-01-23 20:25 <DIR> d----c--- C:\Documents and Settings\Brandy\Application Data\SUPERAntiSpyware.com
2008-01-23 20:20 . 2007-09-24 23:31 69,632 --a--c--- C:\WINDOWS\system32\javacpl.cpl
2008-01-22 20:33 . 2008-01-22 20:33 <DIR> d----c--- C:\Documents and Settings\Brandy\Application Data\Grisoft
2008-01-22 20:32 . 2008-01-22 20:32 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-22 20:32 . 2007-05-30 05:10 10,872 --a--c--- C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-22 20:14 . 2008-01-22 20:14 <DIR> d----c--- C:\Program Files\??crosoft
2008-01-22 13:22 . 2008-01-22 13:22 4,286 --a--c--- C:\WINDOWS\system32\Jamster.ico
2008-01-22 07:37 . 2008-01-22 07:37 <DIR> d----c--- C:\Program Files\Dot1XCfg
2008-01-21 21:18 . 2008-01-21 21:18 <DIR> d----c--- C:\Documents and Settings\Brandy\Application Data\PlayFirst
2008-01-21 21:18 . 2008-01-21 21:18 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-01-21 20:19 . 2008-01-21 20:19 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\BigFish
2008-01-21 20:18 . 2008-01-21 20:18 <DIR> d--hsc--- C:\WINDOWS\ftpcache
2008-01-21 20:18 . 2008-01-21 20:18 <DIR> d----c--- C:\Documents and Settings\Brandy\Application Data\BigFish
2008-01-21 20:13 . 2008-01-21 20:13 <DIR> d----c--- C:\Program Files\Chocolatier 2 - Secret Ingredients
2008-01-21 20:13 . 2008-02-03 15:06 <DIR> d-a--c--- C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-21 20:12 . 2008-01-21 20:12 <DIR> d----c--- C:\Program Files\bfgclient
2008-01-21 20:12 . 2008-01-21 20:13 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-01-20 18:50 . 2008-01-30 00:41 54,156 --ah-c--- C:\WINDOWS\QTFont.qfn
2008-01-20 18:50 . 2008-01-20 18:50 1,409 --a--c--- C:\WINDOWS\QTFont.for
2008-01-20 18:34 . 2008-01-20 18:34 <DIR> d----c--- C:\Documents and Settings\Brandy\Application Data\Sonic
2008-01-20 18:34 . 2008-01-20 18:34 <DIR> d----c--- C:\Documents and Settings\Brandy\Application Data\Leadertech
2008-01-20 15:44 . 2008-01-20 15:44 <DIR> d----c--- C:\Program Files\PKWARE
2008-01-20 15:44 . 2008-01-20 15:44 <DIR> d----c--- C:\Program Files\Common Files\PKWARE
2008-01-20 15:44 . 2008-01-20 15:44 <DIR> d----c--- C:\Documents and Settings\Brandy\Application Data\PKWARE
2008-01-20 15:44 . 2008-01-20 15:44 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\PKWARE
2008-01-20 15:25 . 2007-06-05 10:56 44,928 --a--c--- C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-20 15:22 . 2007-06-08 09:44 8,576 --a--c--- C:\WINDOWS\system32\drivers\ousfxfrhlwmq.sys
2008-01-20 15:20 . 2007-06-08 09:44 8,576 --a--c--- C:\WINDOWS\system32\drivers\RkPavProc.sys
2008-01-20 15:13 . 2007-10-10 16:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-20 15:13 . 2007-06-30 20:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-20 15:13 . 2007-06-30 20:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-20 15:13 . 2007-10-10 16:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-20 15:13 . 2007-10-10 16:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-20 15:13 . 2007-10-10 16:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-20 15:13 . 2007-10-10 16:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-20 15:13 . 2007-10-10 16:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-20 15:13 . 2007-10-10 03:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-20 15:08 . 2008-01-20 15:08 30,590 --a--c--- C:\WINDOWS\system32\pavas.ico
2008-01-20 15:08 . 2008-01-20 15:08 2,550 --a--c--- C:\WINDOWS\system32\Uninstall.ico
2008-01-20 15:08 . 2008-01-20 15:08 1,406 --a--c--- C:\WINDOWS\system32\Help.ico
2008-01-20 15:07 . 2008-01-20 15:22 <DIR> d----c--- C:\WINDOWS\system32\ActiveScan
2008-01-20 09:53 . 2008-01-20 09:53 <DIR> d----c--- C:\Documents and Settings\Brandy\Application Data\GTek
2008-01-20 09:53 . 2008-01-20 09:53 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Gtek
2008-01-20 09:53 . 2008-01-20 09:53 45,216 --a--c--- C:\WINDOWS\system32\OEMINFO.PNF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 01:55 --------- dc----w C:\Program Files\LimeWire
2008-01-25 01:54 --------- dc----w C:\Program Files\iPod
2008-01-25 01:50 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-01-24 16:47 --------- dc----w C:\Documents and Settings\Brandy\Application Data\LimeWire
2008-01-24 03:20 --------- dc----w C:\Program Files\Java
2008-01-23 03:14 --------- dc----w C:\Program Files\??crosoft
2008-01-21 05:02 --------- dc----w C:\Program Files\Canon
2008-01-21 01:51 --------- dc----w C:\Documents and Settings\Brandy\Application Data\Apple Computer
2008-01-20 22:54 418 -c--a-w C:\Documents and Settings\Brandy\Application Data\wklnhst.dat
2008-01-20 22:42 --------- dc----w C:\Program Files\mozilla.org
2008-01-20 16:01 --------- dc----w C:\Program Files\Common Files\Symantec Shared
2008-01-20 16:00 --------- dc----w C:\Program Files\Winamp
2008-01-20 15:59 --------- dc-h--r C:\Documents and Settings\Brandy\Application Data\yahoo!
2008-01-20 15:59 --------- dc----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-20 15:57 --------- dc----w C:\Program Files\Yahoo!
2008-01-20 15:57 --------- dc----w C:\Program Files\Advanced Spyware Remover Pro
2008-01-20 15:52 --------- dc----w C:\Program Files\Symantec AntiVirus
2008-01-20 15:37 --------- dc----w C:\Program Files\HPQ
2008-01-20 15:36 --------- dc----w C:\Program Files\Google
2008-01-20 15:34 --------- dc----w C:\Program Files\Flock
2008-01-20 15:34 --------- dc----w C:\Documents and Settings\Brandy\Application Data\Flock
2008-01-20 15:31 --------- dc----w C:\Program Files\AIM
2008-01-20 15:31 --------- dc----w C:\Documents and Settings\Brandy\Application Data\Aim
2008-01-20 15:24 --------- dc----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-20 15:23 --------- dc----w C:\Documents and Settings\Briana VanAcker\Application Data\Lavasoft
2007-12-31 22:25 --------- dc----w C:\Program Files\Common Files\Apple
2007-12-31 22:23 --------- dc----w C:\Program Files\QuickTime
2007-12-31 22:22 --------- dc----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-31 22:20 --------- dc----w C:\Program Files\Apple Software Update
2007-12-31 22:20 --------- dc----w C:\Documents and Settings\All Users\Application Data\Apple
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-05 20:34 65,480 -c--a-w C:\WINDOWS\system32\gsfcttmk.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
-c--a-w 67,160 2005-08-05 22:08:26 C:\Program Files\AIM\bak\aim.exe

-c--a-w 339,968 2005-03-23 04:05:00 C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe

-c--a-w 66,680 2004-02-29 23:44:46 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe

-c--a-w 241,664 2003-12-22 15:38:42 C:\Program Files\Hp\hpcoretech\bak\hpcmpmgr.exe

-c--a-w 233,534 2005-02-17 21:01:20 C:\Program Files\HPQ\Default Settings\bak\cpqset.exe

-c--a-w 1,048,576 2004-01-27 05:47:22 C:\Program Files\PureEdge\Viewer 6.0\bak\masqform.exe

-c--a-w 155,648 2006-04-24 17:48:44 C:\Program Files\QuickTime\bak\qttask.exe
-c--a-w 286,720 2007-12-11 17:56:54 C:\Program Files\QuickTime\QTTask.exe

-c--a-w 124,128 2004-03-12 22:18:32 C:\Program Files\Symantec AntiVirus\bak\VPTray.exe

-c--a-w 729,177 2005-08-02 00:07:44 C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe

-c--a-w 82,009 2005-07-29 02:26:06 C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe

-c--a-w 111,816 2004-11-11 04:15:31 C:\Program Files\Viewpoint\Viewpoint Manager\bak\ViewMgr.exe

-c--a-w 4,621,816 2006-09-13 21:17:28 C:\Program Files\Yahoo!\Messenger\bak\YahooMessenger.exe

-c--a-w 3,334,144 2006-05-02 22:51:06 C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.EXE

-c--a-w 15,360 2004-08-04 12:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-04 12:00:00 C:\WINDOWS\system32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{611B18AA-D848-ABEE-4B15-898DB92DD3B9}]
C:\WINDOWS\system32\qfvs.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8371ab41-07fc-48da-9f7a-fc98909b85ac}]
C:\WINDOWS\system32\xrrqtjvc.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"Dot1XCfg"="C:\Program Files\Dot1XCfg\Dot1XCfg.exe" [2008-01-22 07:37 61440]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ProfileWatcher"="C:\Documents and Settings\Brandy\ProfileWatcher\profilewatcher.exe" [ ]
"{75A175BE-07C6-1033-0531-050503030001}"="C:\Program Files\Common Files\{75A175BE-07C6-1033-0531-050503030001}\Update.exe" [ ]
"QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 21:07 192512]
"75a17511"="C:\WINDOWS\system32\mrendhpo.dll" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\progra~1\mozill~1\plugins\GetFlash.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
SecureZIP Attachments Status.lnk - C:\Program Files\PKWARE\PKZIPM\11.20.0008\PKTray.exe [2008-01-20 15:44:28 197984]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcaxwt]
efcaxwt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyx]
C:\WINDOWS\system32\gebyx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
--a--c--- 2004-10-14 13:54 253952 c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
-----c--- 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a--c--- 2007-12-11 10:56 286720 C:\Program Files\QuickTime\qttask.exe

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-03-22 07:39]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cccfa74e-c777-11dc-8cdc-00904bf379cb}]
\Shell\AutoRun\command - E:\LinksysConnectPC.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-02-02 19:05:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 15:32:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-03 15:34:54
ComboFix-quarantined-files.txt 2008-02-03 22:34:32
ComboFix2.txt 2008-01-25 04:05:50
.
2008-01-22 04:51:29 --- E O F ---


HIJACKTHIS LOG:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:37:42 PM, on 2/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {611B18AA-D848-ABEE-4B15-898DB92DD3B9} - C:\WINDOWS\system32\qfvs.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: {ca58b909-89cf-a7f9-ad84-cf7014ba1738} - {8371ab41-07fc-48da-9f7a-fc98909b85ac} - C:\WINDOWS\system32\xrrqtjvc.dll (file missing)
O4 - HKLM\..\Run: [ProfileWatcher] C:\Documents and Settings\Brandy\ProfileWatcher\profilewatcher.exe
O4 - HKLM\..\Run: [{75A175BE-07C6-1033-0531-050503030001}] "C:\Program Files\Common Files\{75A175BE-07C6-1033-0531-050503030001}\Update.exe" te-110-12-0000213
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [75a17511] rundll32.exe "C:\WINDOWS\system32\mrendhpo.dll",b
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] c:\progra~1\mozill~1\plugins\GetFlash.exe -p (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] c:\progra~1\mozill~1\plugins\GetFlash.exe -p (User 'Default user')
O4 - Global Startup: SecureZIP Attachments Status.lnk = C:\Program Files\PKWARE\PKZIPM\11.20.0008\PKTray.exe
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZCxdm768YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...tup1.0.0.15.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122658486415
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: efcaxwt - efcaxwt.dll (file missing)
O20 - Winlogon Notify: gebyx - C:\WINDOWS\system32\gebyx.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 6113 bytes

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\WINDOWS\system32\drivers\ousfxfrhlwmq.sys
  C:\WINDOWS\system32\gsfcttmk.dll
  C:\Program Files\Dot1XCfg
  C:\WINDOWS\system32\gebyx.dll
  C:\WINDOWS\system32\mrendhpo.dll
  C:\Program Files\Common Files\{75A175BE-07C6-1033-0531-050503030001}
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcaxwt
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyx
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Dot1XCfg
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\{75A175BE-07C6-1033-0531-050503030001}
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\75a17511
  purity

  
  
• Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
=====================================
After that You have a downloader trojan called Downloader.Agent.awf or Downloader.Agent.ayy. This trojan replaces legitimate files that are common on most computers with an infected file. It then moves the legitimate file to a "bak" or backup folder. Please follow the directions below to run FindAWF so we can identify the files that have been infected and the backups then restore them.

Download FindAWF.exe from here or here, and save it to your desktop.

• Double-click on the FindAWF.exe file to run it.
• It will open a command prompt and ask you to "Press any key to continue".
• You will be presented with a Menu.
  

  1. Press 1 then Enter to scan for bak folders
  2. Press 2 then Enter to restore files from bak folders
  3. Press 3 then Enter to remove bak folders
  4. Press 4 then Enter to reset domain zones
  5. Press E then Enter to EXIT

• Press 1, then press Enter
• It may take a few minutes to complete so be patient.
• When it is complete, it will open a text file in notepad called AWF.txt.
• Please copy and paste the contents of the AWF.txt file in your next reply.

==========
PLease post the AWF log and the OTMove it2 log and a new Hijakthis log.

OK, all that is done. Here are the new logs:

OT Move it:

[Custom Input]
< C:\WINDOWS\system32\drivers\ousfxfrhlwmq.sys >
File/Folder C:\WINDOWS\system32\drivers\ousfxfrhlwmq.sys not found.
< C:\WINDOWS\system32\gsfcttmk.dll >
File/Folder C:\WINDOWS\system32\gsfcttmk.dll not found.
< C:\Program Files\Dot1XCfg >
File/Folder C:\Program Files\Dot1XCfg not found.
< C:\WINDOWS\system32\gebyx.dll >
File/Folder C:\WINDOWS\system32\gebyx.dll not found.
< C:\WINDOWS\system32\mrendhpo.dll >
File/Folder C:\WINDOWS\system32\mrendhpo.dll not found.
< C:\Program Files\Common Files\{75A175BE-07C6-1033-0531-050503030001} >
File/Folder C:\Program Files\Common Files\{75A175BE-07C6-1033-0531-050503030001} not found.
< HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcaxwt >
Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcaxwt\\ deleted successfully.
< HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyx >
Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyx\\ deleted successfully.
< HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Dot1XCfg >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Dot1XCfg deleted successfully.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\{75A175BE-07C6-1033-0531-050503030001} >
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\{75A175BE-07C6-1033-0531-050503030001} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A175BE-07C6-1033-0531-050503030001}\ not found.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\75a17511 >
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\75a17511 deleted successfully.
< purity >
C:\Program Files\Міcrosoft moved successfully.

OTMoveIt2 v1.0.17 log created on 02032008_185817


AWF Log:


Find AWF report by noahdfear ©2006
Version 1.40

The current date is: Sun 02/03/2008
The current time is: 19:01:39.87


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\AIM\BAK

08/05/2005 03:08 PM 67,160 aim.exe
1 File(s) 67,160 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

04/24/2006 10:48 AM 155,648 qttask.exe
1 File(s) 155,648 bytes

Directory of C:\PROGRA~1\SYMANT~1\BAK

03/12/2004 03:18 PM 124,128 VPTray.exe
1 File(s) 124,128 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

08/04/2004 05:00 AM 15,360 ctfmon.exe
1 File(s) 15,360 bytes

Directory of C:\PROGRA~1\ATITEC~1\ATICON~1\BAK

03/22/2005 09:05 PM 339,968 atiptaxx.exe
1 File(s) 339,968 bytes

Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK

02/29/2004 04:44 PM 66,680 ccApp.exe
1 File(s) 66,680 bytes

Directory of C:\PROGRA~1\HP\HPCORE~1\BAK

12/22/2003 08:38 AM 241,664 hpcmpmgr.exe
1 File(s) 241,664 bytes

Directory of C:\PROGRA~1\HPQ\DEFAUL~1\BAK

02/17/2005 02:01 PM 233,534 cpqset.exe
1 File(s) 233,534 bytes

Directory of C:\PROGRA~1\PUREEDGE\VIEWER~1.0\BAK

01/26/2004 10:47 PM 1,048,576 masqform.exe
1 File(s) 1,048,576 bytes

Directory of C:\PROGRA~1\SYNAPT~1\SYNTP\BAK

08/01/2005 05:07 PM 729,177 SynTPEnh.exe
07/28/2005 07:26 PM 82,009 SynTPLpr.exe
2 File(s) 811,186 bytes

Directory of C:\PROGRA~1\VIEWPO~1\VIEWPO~2\BAK

11/10/2004 09:15 PM 111,816 ViewMgr.exe
1 File(s) 111,816 bytes

Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK

05/02/2006 03:51 PM 3,334,144 YAHOOM~1.EXE
09/13/2006 02:17 PM 4,621,816 YahooMessenger.exe
2 File(s) 7,955,960 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

67160 Aug 5 2005 "C:\Program Files\AIM\bak\aim.exe"
286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe"
155648 Apr 24 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
124128 Mar 12 2004 "C:\Program Files\Symantec AntiVirus\bak\VPTray.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
339968 Mar 22 2005 "C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
66680 Feb 29 2004 "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe"
58488 Aug 28 2004 "C:\SWSETUP\SYMIS\US\Support\ccCommon\ccCommon\ccApp.exe"
241664 Dec 22 2003 "C:\Program Files\Hp\hpcoretech\bak\hpcmpmgr.exe"
233534 Feb 17 2005 "C:\Program Files\HPQ\Default Settings\bak\cpqset.exe"
1048576 Jan 26 2004 "C:\Program Files\PureEdge\Viewer 6.0\bak\masqform.exe"
692316 Feb 2 2005 "C:\SWSETUP\Touchpad\SynTPEnh.exe"
729177 Aug 1 2005 "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe"
729177 Aug 1 2005 "C:\Program Files\Synaptics\SynTP\Media\SynTPEnh.exe"
729177 Aug 1 2005 "C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\SynTPEnh.exe"
102492 Feb 2 2005 "C:\SWSETUP\Touchpad\SynTPLpr.exe"
82009 Jul 28 2005 "C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe"
82009 Jul 28 2005 "C:\Program Files\Synaptics\SynTP\Media\SynTPLpr.exe"
82009 Jul 28 2005 "C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\SynTPLpr.exe"
111816 Nov 10 2004 "C:\Program Files\Viewpoint\Viewpoint Manager\bak\ViewMgr.exe"
3334144 May 2 2006 "C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.EXE"
4621816 Sep 13 2006 "C:\Program Files\Yahoo!\Messenger\bak\YahooMessenger.exe"


end of report


NEW HIJACKTHIS LOG:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:04:17 PM, on 2/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {611B18AA-D848-ABEE-4B15-898DB92DD3B9} - C:\WINDOWS\system32\qfvs.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: {ca58b909-89cf-a7f9-ad84-cf7014ba1738} - {8371ab41-07fc-48da-9f7a-fc98909b85ac} - C:\WINDOWS\system32\xrrqtjvc.dll (file missing)
O4 - HKLM\..\Run: [ProfileWatcher] C:\Documents and Settings\Brandy\ProfileWatcher\profilewatcher.exe
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] c:\progra~1\mozill~1\plugins\GetFlash.exe -p (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] c:\progra~1\mozill~1\plugins\GetFlash.exe -p (User 'Default user')
O4 - Global Startup: SecureZIP Attachments Status.lnk = C:\Program Files\PKWARE\PKZIPM\11.20.0008\PKTray.exe
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZCxdm768YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...tup1.0.0.15.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122658486415
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 5804 bytes

• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  Insert Files to be moved
  
  "C:\Program Files\AIM\bak\aim.exe"
  "C:\Program Files\QuickTime\bak\qttask.exe"
  "C:\Program Files\Symantec AntiVirus\bak\VPTray.exe"
  "C:\WINDOWS\system32\bak\ctfmon.exe"
  "C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
  "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe"
  "C:\Program Files\Hp\hpcoretech\bak\hpcmpmgr.exe"
  "C:\Program Files\HPQ\Default Settings\bak\cpqset.exe"
  "C:\Program Files\PureEdge\Viewer 6.0\bak\masqform.exe"
  "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe"
  "C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe"
  "C:\Program Files\Viewpoint\Viewpoint Manager\bak\ViewMgr.exe"
  "C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.EXE"
  "C:\Program Files\Yahoo!\Messenger\bak\YahooMessenger.exe"
  
  
• Double-click on the FindAWF.exe file to run it.
• It will open a command prompt and ask you to "Press any key to continue".
• You will be presented with a Menu.
  

  1. Press 1 then Enter to scan for bak folders
  2. Press 2 then Enter to restore files from bak folders
  3. Press 3 then Enter to remove bak folders
  4. Press 4 then Enter to reset domain zones
  5. Press E then Enter to EXIT

• Press 2, then press Enter.
• Press any key to continue.
• A Notepad document FindAWF.txt will appear with instructions to click below the line and paste the list of files to be restored.
• Right click below this line and select Paste, to paste the list of files copied to the clipboard earlier. Save and close the document.
• The program will proceed to move the legit files and will perform another scan for .bak folder
• It may take a few minutes to complete so be patient.
• When it is complete, it will open a text file in notepad called AWF.txt.
• Please copy and paste the contents of the AWF.txt file in your next reply.

Did what you asked. Here is the AWF File:


Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully

The current date is: Wed 02/06/2008
The current time is: 21:22:03.35


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\AIM\BAK

08/05/2005 03:08 PM 67,160 aim.exe
1 File(s) 67,160 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

04/24/2006 10:48 AM 155,648 qttask.exe
1 File(s) 155,648 bytes

Directory of C:\PROGRA~1\SYMANT~1\BAK

03/12/2004 03:18 PM 124,128 VPTray.exe
1 File(s) 124,128 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

08/04/2004 05:00 AM 15,360 ctfmon.exe
1 File(s) 15,360 bytes

Directory of C:\PROGRA~1\ATITEC~1\ATICON~1\BAK

03/22/2005 09:05 PM 339,968 atiptaxx.exe
1 File(s) 339,968 bytes

Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK

02/29/2004 04:44 PM 66,680 ccApp.exe
1 File(s) 66,680 bytes

Directory of C:\PROGRA~1\HP\HPCORE~1\BAK

12/22/2003 08:38 AM 241,664 hpcmpmgr.exe
1 File(s) 241,664 bytes

Directory of C:\PROGRA~1\HPQ\DEFAUL~1\BAK

02/17/2005 02:01 PM 233,534 cpqset.exe
1 File(s) 233,534 bytes

Directory of C:\PROGRA~1\PUREEDGE\VIEWER~1.0\BAK

01/26/2004 10:47 PM 1,048,576 masqform.exe
1 File(s) 1,048,576 bytes

Directory of C:\PROGRA~1\SYNAPT~1\SYNTP\BAK

08/01/2005 05:07 PM 729,177 SynTPEnh.exe
07/28/2005 07:26 PM 82,009 SynTPLpr.exe
2 File(s) 811,186 bytes

Directory of C:\PROGRA~1\VIEWPO~1\VIEWPO~2\BAK

11/10/2004 09:15 PM 111,816 ViewMgr.exe
1 File(s) 111,816 bytes

Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK

05/02/2006 03:51 PM 3,334,144 YAHOOM~1.EXE
09/13/2006 02:17 PM 4,621,816 YahooMessenger.exe
2 File(s) 7,955,960 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

67160 Aug 5 2005 "C:\Program Files\AIM\aim.exe"
67160 Aug 5 2005 "C:\Program Files\AIM\bak\aim.exe"
155648 Apr 24 2006 "C:\Program Files\QuickTime\qttask.exe"
155648 Apr 24 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
124128 Mar 12 2004 "C:\Program Files\Symantec AntiVirus\VPTray.exe"
124128 Mar 12 2004 "C:\Program Files\Symantec AntiVirus\bak\VPTray.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
339968 Mar 22 2005 "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
339968 Mar 22 2005 "C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
66680 Feb 29 2004 "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
66680 Feb 29 2004 "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe"
58488 Aug 28 2004 "C:\SWSETUP\SYMIS\US\Support\ccCommon\ccCommon\ccApp.exe"
241664 Dec 22 2003 "C:\Program Files\Hp\hpcoretech\hpcmpmgr.exe"
241664 Dec 22 2003 "C:\Program Files\Hp\hpcoretech\bak\hpcmpmgr.exe"
233534 Feb 17 2005 "C:\Program Files\HPQ\Default Settings\cpqset.exe"
233534 Feb 17 2005 "C:\Program Files\HPQ\Default Settings\bak\cpqset.exe"
1048576 Jan 26 2004 "C:\Program Files\PureEdge\Viewer 6.0\masqform.exe"
1048576 Jan 26 2004 "C:\Program Files\PureEdge\Viewer 6.0\bak\masqform.exe"
692316 Feb 2 2005 "C:\SWSETUP\Touchpad\SynTPEnh.exe"
729177 Aug 1 2005 "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
729177 Aug 1 2005 "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe"
729177 Aug 1 2005 "C:\Program Files\Synaptics\SynTP\Media\SynTPEnh.exe"
729177 Aug 1 2005 "C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\SynTPEnh.exe"
102492 Feb 2 2005 "C:\SWSETUP\Touchpad\SynTPLpr.exe"
82009 Jul 28 2005 "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
82009 Jul 28 2005 "C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe"
82009 Jul 28 2005 "C:\Program Files\Synaptics\SynTP\Media\SynTPLpr.exe"
82009 Jul 28 2005 "C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\SynTPLpr.exe"
111816 Nov 10 2004 "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe"
111816 Nov 10 2004 "C:\Program Files\Viewpoint\Viewpoint Manager\bak\ViewMgr.exe"
3334144 May 2 2006 "C:\Program Files\Yahoo!\Messenger\YAHOOM~1.EXE"
3334144 May 2 2006 "C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.EXE"
4621816 Sep 13 2006 "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"
4621816 Sep 13 2006 "C:\Program Files\Yahoo!\Messenger\bak\YahooMessenger.exe"


end of report

• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  
  
  C:\Program Files\AIM\bak
  C:\Program Files\QuickTime\bak
  C:\Program Files\Symantec AntiVirus\bak
  C:\WINDOWS\system32\bak
  C:\Program Files\ATI Technologies\ATI Control Panel\bak
  C:\Program Files\Common Files\Symantec Shared\bak
  C:\Program Files\Hp\hpcoretech\bak
  C:\Program Files\HPQ\Default Settings\bak
  C:\Program Files\PureEdge\Viewer 6.0\bak
  C:\Program Files\Synaptics\SynTP\bak
  C:\Program Files\Viewpoint\Viewpoint Manager\bak
  C:\Program Files\Yahoo!\Messenger\bak
  C:\Program Files\Messenger\bak
  
  
  
• Double-click on the FindAWF.exe file to run it.
• It will open a command prompt and ask you to "Press any key to continue".
• You will be presented with a Menu.
  

  1. Press 1 then Enter to scan for bak folders
  2. Press 2 then Enter to restore files from bak folders
  3. Press 3 then Enter to remove bak folders
  4. Press 4 then Enter to reset domain zones
  5. Press E then Enter to EXIT

• Press 3, then press Enter.
• Press any key to continue.
• A Notepad document FindAWF.txt will appear with instructions to click below the line and paste the list of folders to be removed.
• Right click below this line and select Paste, to paste the list of folders copied to the clipboard earlier. Save and close the document.
• The program will proceed to remove the bad folders and will perform another scan for .bak folder
• It may take a few minutes to complete so be patient.
• When it is complete, it will open a text file in notepad called AWF.txt.
• Please copy and paste the contents of the AWF.txt file in your next reply.

Here is my next log report:


Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully

The current date is: Thu 02/07/2008
The current time is: 6:42:39.65


bak folders found
~~~~~~~~~~~



Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report

Please do an online scan with Kaspersky WebScanner
(This scanner is for use with internet explorer only)
Click on "Accept"

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Okay, here is my kapersky report:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, February 08, 2008 1:14:19 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 8/02/2008
Kaspersky Anti-Virus database records: 555459
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 64129
Number of viruses found: 28
Number of infected objects: 69
Number of suspicious objects: 0
Duration of the scan process: 01:35:40

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\07ca83489ecf81bce3d9c98137513aa7_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\08da1aa34b258bc1d5eca45e90e9a619_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0939b752a47f2085a87164ea5c936eca_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\09643334861540575e0777ace557f67b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0a2f3e8411e987ebd756809d18c5c5fd_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0b7c825f5389a97148d089be0345ce13_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0bb9da91304288c82d3886f7b5c44de6_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0caed58adbf18a6e186f52afedd4cd4f_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0d32a8b3a64c13febb3ebdb5fcc89eec_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0e06e6e3549d853929eb32435a20028b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1112d8568897d9fd34a690423caca1cb_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1673a48b7b289ce778fee43dc1e8ab9e_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1b91b51e18899a7fe43fd04a46e5e3d6_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1d079763f9371d4ff6b5ba3b382f8b65_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\24f58667e8e80d8062366d8550e035cf_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\280b7f0237bb92fb6f64e37ebd4fe8b3_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\284fe057ca7f4068c44fe717a12c3e17_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\29130a47da7eea98439cbad446e42265_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2c59b9c4adee65503a31839bbc30cb65_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2f94524ae6ad0310f16d54bffcbde8cc_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2fc4acec84a6f0d309615b34a23c29dc_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\33bb1284b0929be4d75ddc6b18da347d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3478cc5b019d60fc0d45c68b4cc0dcbc_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\347b9839bba9d3da9bbf58699f2f290a_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\34a1209711a19da19f1b473e9f376fb2_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\34a7e0b8122f913222cf4221d8b339b9_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3599ad6b7eae63f57084ca11d2c71064_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3738c5dbe40739cc40eaa16ba7c79265_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\37727a15cffb42512c964c9680c30cb3_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\37c8d090b96a01091a03966e3a7e7f69_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\37e19fe09e8bc3dcca98b32b3a096bfb_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3d82f6d6c2f3d00831da85365cbb0b66_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3fcebb34197fd36f645d0d0146e2e8a9_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\40f730fd6e1c0a808d950ebd2a102e9d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4200055ea7b5040c178749a159ba5e1b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\44ce32bc313b748aad1c47c023b10959_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4573f7d3ebcf6a5f435ffbefde245ef9_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4583ca29db00eee310e86058cffa73b8_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\458dcaf4af64ab02834ddf741fb282d0_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\47b14829326e9c471e40827d1e682383_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\483d39ad4e8a8774bc5253d2512782f4_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\48ae7965689cc6dba380546e019b0e17_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\49c06bd711d09fbafc789808f20beea7_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4c59787065992c0c23ddc099ff93a7aa_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4ffe2e7d9c5c34aec008974eb1e208d5_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\50ddfe7659c3503ccdd8c208fb8d481b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\52ca2315193d374c34138e3c7b187da1_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5314a6db5f1799da8ae0848423099dec_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5b5cf737e3d6ef9b2687be27f481fcda_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5c0655db0ce4940f60e9f7d79d00c504_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5c4f2ada0a573d63d9f7f26a3ee23557_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5fb0cf5994386f9ff83e459d2579af60_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\60ce76811026647dbb79ce8f3532139c_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\64b7be19433a5cf4e97c1d86f080604b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\64fe9022f1d4a0809c2026af3d3ef885_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6769206731b9053070ee56dc73624064_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6852f5ca3767d5f1307c5a898d94cabf_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\686fe9a0db03ddccfbee39bcfcafb9ec_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\694d05bd3e8466dad568f15b151bad94_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6a560e425f9d578de8aeca3068d73afb_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6bc2842d5d08990de26c00051961025c_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6c8f0d76e772f799b5418c2ee719db57_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6f1032599bd0fb0195897dee2c51026b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\71df0b88d1bf171ee2c8639086100d3b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\789aa50da3e69e0d50031c4d29d55769_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7fb0502680236fa6d64ee6f50ec0c6a0_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7fb64ecd50917f91b8528c0cc6c1471e_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\80479a51001b930b29628914fd7993e7_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\82f862a31bd9282a1c187dad0a4fe751_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\84a8dec43bb46014f72f7279026debf4_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8559d289d44d3e5d1211b8db36f8ef11_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\88fbd574da477fad232d656974304382_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\89106c8897432ec8b57bbbfe62439e50_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8beaacb3ae51ceddaf817097e8829023_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8f2236dffdcdcae015c75926ba5f26c2_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9165fd8f968a83205be71079a6a8933b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\91d41a02ad53ae36f43d3b9f9c5858a8_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9218f6112b053d8ae33551f8f3e48b52_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\935f4cb92ad3aa5b5a11e556062bac3f_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\96a72d32bc1eb46baa26685568d0d122_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\99085f4ddf4882330ccef22de5fe7f9a_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\996899dfe0ffbf5b972de8c8239854a4_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9da4fc95d57a044a12410d9b6c0a40e6_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9df06d63dec3301dc8711f6d8d73a7ef_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a2026f3bb7a76f40f52836e0f81cf1c1_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a647a167ff02b714119fd1507ef6fd0d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a6ad30049f7c634609dbb135192dd90d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a6d32336ccbfd9ff54a2a39c2241090c_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a862c6493c15527e3d1e2ffce05fe925_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a8fb1996923a59a184f570be82ba85c1_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a905c047df38abe71d3d3088e64e6221_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a92329d5850b2090d45565ff71342647_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a9a55e80857d0ae38750993e17238e3d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ac37941ed625096d25cc4a0ad34380e5_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\af570fff79e9b13bd2e9661f2cfe8a40_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\afe60e9c2aebe129b7b2ead01ee13cb9_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b1358c908749472d865544710e7b672d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b32bd3efdaee08f39e8e820e854b2ef3_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b6af059745fd6a43d5160df4b55cf986_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b9a79e187362384ad9139b7e3bb8bc43_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ba4e2c1414261d47d11461ace1509346_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bbb69d247a797965ee4c79882196e11b_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bdd0be75dd85e338fd5024bf0c12e947_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bfd39cd60e666b44c67cf55e5b8d6dc0_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bfd73e6d681980192e97c657ec08c71d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c05ea24373e0fbcb0df422aff9a54ebb_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c461589d72b354f7cadb1cf3548aa21d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c4c0c52c4d5ff889fbb37084734e5342_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cafdf6964f0571c9e2b7fb71ae071957_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cbc96e6dbac2132a5fa14f80a4625685_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cc9c4ee66131c9be40674232ff889581_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ce159aa98741788209e1fb4892adf123_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cee262e939712d96678cb0306d3e69a7_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d60afa775c963e236a12dcad6175c864_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d95ed085b992627b9aa0ea86bd44fad7_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dac467188d7b2937dc9a0b71a2004179_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dba3a7fae1e38ce191360ed4b3345130_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dc3b5250a9d1a117e527216fe68473c9_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dd886238d8b51c337e1954012e44882d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\de1ac637c5cdcab593a07f6cfd5f36a6_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dea8c6d096552d003efb1a9051629edc_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\deb9fd27d023bec8ec94d2ae0ffbb07c_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\df4d15f30dfc9e9c1db8bd72f0ba314d_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e11994abcf781669404304ae99bab274_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e2d00527294798387cde36d89c860929_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e6dfebe6be459b60930eb1a72758f01e_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e71342476a51bcb0b15c71c19e304560_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e9303fd9bd3f15d2e537cea1d02a12a5_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ee24eccd6799cff6290c451478ebd035_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f0b216c010adf6731a44c3f9934e5aec_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f17d58dfce818fa8a3d939fbbe095235_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f86928829842f5dbcd7f3cd85341a818_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fe6cf66a6bf22892441fd93e3970b8f6_28ba53cb-4fa2-42f9-ad9c-ef3d120fdd23 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\0102\0310\values Object is locked skipped
C:\Documents and Settings\Brandy\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped
C:\Documents and Settings\Brandy\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Brandy\Desktop\1111\01 Track 1 (boondock).wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\Brandy\Desktop\1111\01 Track 1.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\Brandy\Desktop\1111\02 Track 2 (boondock).wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\Brandy\Desktop\1111\03 Track 3 (boondock).wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\Brandy\Desktop\1111\06 Track 6 (boondock).wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\Brandy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Brandy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Brandy\Local Settings\Application Data\SupportSoft\quickcare\Brandy\state\logs\sprtcmd.log Object is locked skipped
C:\Documents and Settings\Brandy\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Brandy\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Brandy\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Brandy\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Brandy\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Briana VanAcker\Application Data\Microsoft\Windows\nntod.exe Infected: Trojan-Downloader.Win32.Agent.hcm skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\Program Files\Temporary\kernInst.exe.vir Infected: Trojan.Win32.Agent.edq skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dryywhfa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\esdnrmdq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063505.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063506.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063507.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063508.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063516.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063517.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063518.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063519.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063520.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063522.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063523.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063524.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063525.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063526.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063527.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063528.SCR Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063529.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063530.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063531.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.a skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063532.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063533.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063534.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bh skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063536.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063537.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063539.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063541.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063542.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063543.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063545.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063546.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063547.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP279\A0063548.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP280\A0063673.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP280\A0063674.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP280\A0063675.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP280\A0063676.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP280\A0063678.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP281\A0065453.exe/mwsSetup.CommonCodebase.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP281\A0065453.exe CAB: infected - 1 skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067489.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067489.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067490.exe Infected: Trojan.Win32.Scapur.k skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067517.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067517.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067517.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067518.exe Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067576.exe Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067582.exe Infected: not-a-virus:Downloader.Win32.WinFixer.x skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067583.exe Infected: not-a-virus:AdWare.Win32.Agent.aaq skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP288\A0067584.exe Infected: not-a-virus:AdWare.Win32.Agent.tj skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP290\A0067606.exe Infected: not-a-virus:FraudTool.Win32.SpySheriff.a skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP293\A0069860.exe Infected: Trojan-Downloader.Win32.Delf.dlk skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP293\A0069863.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP294\A0069879.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP294\A0069880.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP294\A0069881.exe Infected: Trojan.Win32.Agent.edq skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{9FD16401-CEF7-49F0-9E7B-FFD35C0C715A}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\iypocvqs.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\system32\ocboisqs.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wsxgkhvg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\_OTMoveIt\MovedFiles\02032008_185710\Program Files\Dot1XCfg\Dot1XCfg.exe Infected: Trojan-Downloader.Win32.Adload.pr skipped

Scan process completed.

• Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\WINDOWS\system32\iypocvqs.dll 
  C:\WINDOWS\system32\ocboisqs.dll 
  C:\WINDOWS\system32\wsxgkhvg.dll 
  C:\Documents and Settings\Brandy\Desktop\1111\01 Track 1 (boondock).wma 
  C:\Documents and Settings\Brandy\Desktop\1111\01 Track 1.wma
  C:\Documents and Settings\Brandy\Desktop\1111\02 Track 2 (boondock).wma 
  C:\Documents and Settings\Brandy\Desktop\1111\03 Track 3 (boondock).wma
  C:\Documents and Settings\Brandy\Desktop\1111\06 Track 6 (boondock).wma 
  C:\Documents and Settings\Briana VanAcker\Application Data\Microsoft\Windows\nntod.exe

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
• Click the red Moveit! button.
• OTMoveit2 will create a log of moved files in the C:\_OTMoveIt\MovedFiles folder. The log's name will appear as the date and time it was created, with the format mmddyyyy_hhmmss.log. Open this log in Notepad and post its contents in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
=====================================
Also post a new Hijackthis log as well.

Okay, here is my hijackthis log and OTMoveIt Log:

OTMoveIt2 Log:
LoadLibrary failed for C:\WINDOWS\system32\iypocvqs.dll
C:\WINDOWS\system32\iypocvqs.dll NOT unregistered.
C:\WINDOWS\system32\iypocvqs.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\ocboisqs.dll
C:\WINDOWS\system32\ocboisqs.dll NOT unregistered.
C:\WINDOWS\system32\ocboisqs.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\wsxgkhvg.dll
C:\WINDOWS\system32\wsxgkhvg.dll NOT unregistered.
C:\WINDOWS\system32\wsxgkhvg.dll moved successfully.
C:\Documents and Settings\Brandy\Desktop\1111\01 Track 1 (boondock).wma moved successfully.
C:\Documents and Settings\Brandy\Desktop\1111\01 Track 1.wma moved successfully.
C:\Documents and Settings\Brandy\Desktop\1111\02 Track 2 (boondock).wma moved successfully.
C:\Documents and Settings\Brandy\Desktop\1111\03 Track 3 (boondock).wma moved successfully.
C:\Documents and Settings\Brandy\Desktop\1111\06 Track 6 (boondock).wma moved successfully.
C:\Documents and Settings\Briana VanAcker\Application Data\Microsoft\Windows\nntod.exe moved successfully.

OTMoveIt2 v1.0.17 log created on 02092008_202128


HIJACKTHIS Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:24:28 PM, on 2/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.geekstogo...ps-t186207.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {611B18AA-D848-ABEE-4B15-898DB92DD3B9} - C:\WINDOWS\system32\qfvs.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: {ca58b909-89cf-a7f9-ad84-cf7014ba1738} - {8371ab41-07fc-48da-9f7a-fc98909b85ac} - C:\WINDOWS\system32\xrrqtjvc.dll (file missing)
O4 - HKLM\..\Run: [ProfileWatcher] C:\Documents and Settings\Brandy\ProfileWatcher\profilewatcher.exe
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] c:\progra~1\mozill~1\plugins\GetFlash.exe -p (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] c:\progra~1\mozill~1\plugins\GetFlash.exe -p (User 'Default user')
O4 - Global Startup: SecureZIP Attachments Status.lnk = C:\Program Files\PKWARE\PKZIPM\11.20.0008\PKTray.exe
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZCxdm768YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...tup1.0.0.15.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122658486415
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 6133 bytes

Please re-open Hijackthis and click on "Do a system scan only"
Then place a check mark next to these entries below:

O2 - BHO: (no name) - {611B18AA-D848-ABEE-4B15-898DB92DD3B9} - C:\WINDOWS\system32\qfvs.dll (file missing)
O2 - BHO: {ca58b909-89cf-a7f9-ad84-cf7014ba1738} - {8371ab41-07fc-48da-9f7a-fc98909b85ac} - C:\WINDOWS\system32\xrrqtjvc.dll (file missing)
O20 - AppInit_DLLs:

Now click on Fix Checked and then close Hijackthis.
==================================
Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
  

Please then delete all other tools if any that I had you download.
Empty your recycle bin.
==========================
After that Your log is clean.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein ->Here