[efes5]

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.areslimited.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {E1A52565-EE8A-B852-ACAE-90CB24945CC1} - C:\WINDOWS\system32\exv.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [THGuard] "F:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Internet Window Washer] F:\Program Files\Free Internet Window Washer\Clearpch.exe -Start
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewid...oOnlineScan.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1135318542787
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zone.../ICSScanner.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius....tiveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://www.pandasoft...5/ASPROinst.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - F:\MATLAB7\webserver\bin\win32\matlabserver.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

[Advertisements]

Please open HijackThis, click Do a system scan only, and then place a checkmark beside each of these entries:

O2 - BHO: (no name) - {E1A52565-EE8A-B852-ACAE-90CB24945CC1} - C:\WINDOWS\system32\exv.dll (file missing)

After placing all the checkmarks, close all windows (except HJT), and then hit Fix Checked. When it finishes, exit HJT.

=====================================

Locate and delete the following file(s), if present : C:\WINDOWS\system32\exv.dll
=====================================

Download ATF Cleaner

• Double-click ATF-Cleaner.exe to run the program.
• Click Select All found at the bottom of the list.
• Click the Empty Selected button.

If you use Firefox browser, do this also:

• Click Firefox at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

• Click Opera at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

=====================================

Run an online scan at Panda's ActiveScan

• Please go here using Internet Explorer.
• Once you are on the Panda site click the Scan your PC button.
• A new window will open, click the big Check Now button.
  • Enter your Country.
  • Enter your State/Province.
  • Enter your e-mail address and click send.
  • Select either Home User or Company.
  • Click the big Scan Now button.
• If it wants to install an ActiveX component allow it.
• It will start downloading the files it requires for the scan.
• When the download is complete, click on My Computer to start the scan.
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

=====================================

In your next reply, please include these log(s):

• HijackThis log (new and also include the upper part)
• Panda

[Jag11]

Please open HijackThis, click Do a system scan only, and then place a checkmark beside each of these entries:

O2 - BHO: (no name) - {E1A52565-EE8A-B852-ACAE-90CB24945CC1} - C:\WINDOWS\system32\exv.dll (file missing)

After placing all the checkmarks, close all windows (except HJT), and then hit Fix Checked. When it finishes, exit HJT.

=====================================

Locate and delete the following file(s), if present : C:\WINDOWS\system32\exv.dll
=====================================

Download ATF Cleaner

• Double-click ATF-Cleaner.exe to run the program.
• Click Select All found at the bottom of the list.
• Click the Empty Selected button.

If you use Firefox browser, do this also:

• Click Firefox at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

• Click Opera at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

=====================================

Run an online scan at Panda's ActiveScan

• Please go here using Internet Explorer.
• Once you are on the Panda site click the Scan your PC button.
• A new window will open, click the big Check Now button.
  • Enter your Country.
  • Enter your State/Province.
  • Enter your e-mail address and click send.
  • Select either Home User or Company.
  • Click the big Scan Now button.
• If it wants to install an ActiveX component allow it.
• It will start downloading the files it requires for the scan.
• When the download is complete, click on My Computer to start the scan.
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

=====================================

In your next reply, please include these log(s):

• HijackThis log (new and also include the upper part)
• Panda

[efes5]

Thanks for your help! I've done what you told me. Below are the hijackthis and panda logs. I also had one question: When one runs a hijackthis, panda or a virus scan does that program scan all the users' files even though one is logged in through only one account? I'm asking this because it seems that one of the user accounts on my computer seems even a lot slower than another one. Again, thanks for your help!



Logfile of HijackThis v1.99.1
Scan saved at 11:45:37 AM, on 8/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
F:\Program Files\TrojanHunter 4.5\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.areslimited.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [THGuard] "F:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Internet Window Washer] F:\Program Files\Free Internet Window Washer\Clearpch.exe -Start
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewid...oOnlineScan.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1135318542787
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zone.../ICSScanner.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius....tiveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://www.pandasoft...5/ASPROinst.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - F:\MATLAB7\webserver\bin\win32\matlabserver.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe


Panda's Active Scan's results:

Incident Status Location

Adware:Adware/PurityScan Not disinfected c:\windows\system32\??ppatch\winword.exe
Adware:adware/craft Not disinfected c:\windows\system32\mscnf.dll
Potentially unwanted tool:application/altnet Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\AltnetDM
Adware:adware/spysheriff Not disinfected Windows Registry
Adware:Adware/Comet Not disinfected C:\Program Files\Hijackthis\backups\backup-20050903-161211-723.dll
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\42D73BF4-4AC9-400F-8FC7-197153\5EFF1865-4675-4BE8-A87D-0C09AA
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\42D73BF4-4AC9-400F-8FC7-197153\6AC81275-6F3E-4C90-A5A8-8030A1
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\42D73BF4-4AC9-400F-8FC7-197153\90528D04-D5FA-48B8-B6EC-586952
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\42F00ABC-10C5-43EE-8EF2-22BA38\81BF19AD-7C4B-45C6-A8D7-8C98DE
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\42F00ABC-10C5-43EE-8EF2-22BA38\E04614E6-E09F-4E65-838A-E3A1CE
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\487D9B42-2EB8-440D-A76A-A8D91A\713E7849-E1F0-4D5D-9B4D-B045CD
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\680E237C-2700-4437-9864-B89DF4\380A4631-ED9E-42B6-AB10-7F65A1
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\680E237C-2700-4437-9864-B89DF4\6CB6B145-7953-4872-AB37-3D9E9F
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\8A4EC4BE-6F2C-421C-9E81-E2F2B8\C7B8EBB3-74F7-4E28-B86E-2C7270
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\8A4EC4BE-6F2C-421C-9E81-E2F2B8\F5934114-1AAE-4766-886F-23EE6C
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\A6FEA640-8934-498B-98A3-948E7C\08F6307E-182C-4658-9C3F-B70837
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\A6FEA640-8934-498B-98A3-948E7C\CCB2F74D-2B49-400F-8284-1A5D05
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\A6FEA640-8934-498B-98A3-948E7C\FA83456B-8890-44BD-8FB3-076B1B
Adware:Adware/MediaTickets Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\BC18BB39-61A7-4682-88F6-D3FD78\B9B6BC35-C1DD-41D5-946A-2FFD90
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\E5C44F53-5D23-470C-8FA9-0A3FAE\44782B78-770D-440B-BF7B-0E7937
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\E5C44F53-5D23-470C-8FA9-0A3FAE\61E5BB28-11BA-4F30-97CE-94EEB1
Adware:Adware/PurityScan Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\E5C44F53-5D23-470C-8FA9-0A3FAE\6BB9FC09-69F6-4C47-88E8-12AD9A
Virus:Trj/Craurl.E Disinfected C:\WINDOWS\system32\l?[bleep].exe
Adware:Adware/PurityScan Not disinfected C:\WINDOWS\system32\n?tepad.exe
Adware:Adware/Gator Not disinfected F:\Backup\Program Files.zip[Common Files/CMEII/CMEIIAPI.dll]

[Jag11]

Hi efes5

Thanks for your help!

My pleasure!

I also had one question: When one runs a hijackthis, panda or a virus scan does that program scan all the users' files even though one is logged in through only one account?

Hijackthis - it only scans one account
Panda & Virus Scans - all accounts (if set to scan C: drive)

I'm asking this because it seems that one of the user accounts on my computer seems even a lot slower than another one.

That account might be infected too, so remember me when we already finish this current account that we're cleaning.

Ok let's continue?

You may want to print out these instructions or save it as a text document, and use them as a reference. If you have any questions regarding the fix, please ask us before proceeding. It is also important for you to don't miss a step and perform everything in the right order.

=====================================

Update Java

• Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-1_5_0_08-windows-i586-p to install the newest version.

=====================================

Locate and delete the following folder(s), if present : c:\windows\system32\??ppatch\ <-- the ? marks can be any word, just find the folder that ends with "ppatch" also check first if that folder conatins: winword.exe
=====================================

Locate and delete the following file(s), if present : c:\windows\system32\mscnf.dll
=====================================
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as "All Files" and name it FixME.reg. Please save it on your desktop.

REGEDIT4

[-hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\AltnetDM]

Double click FixME.reg. It will ask you if you want to merge it to the registry, click Yes.

=====================================

Open Microsoft AntiSpyware and empty its quarantine.

=====================================

Copy everything inside the quote box below (starting with dir) and paste it into Notepad.
In Notepad, click File » Save As and click the drop-down box to change the "Save As Type" to All Files. Save it as findfile.bat on your Desktop.

dir C:\WINDOWS\system32\n?tepad.exe /a h > files.txt
notepad files.txt

Locate findfile.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the contents of that Notepad here.

=====================================

Reboot and post a new HJT log. Also post the contents of findfile.bat.

Jet

[Jag11]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.