[roacham]

Hi, I am posting this for my sister. We did as nuch as we could before posting this but her computer is not allowing her to do much at this time. She keeps getting pop-ups and not able to stay on the internet for to long. Here is her hijack this log. Please help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:57:22 PM, on 1/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:..WINDOWS..System32..smss.exe
C:..WINDOWS..system32..winlogon.exe
C:..WINDOWS..system32..services.exe
C:..WINDOWS..system32..lsass.exe
C:..WINDOWS..system32..svchost.exe
C:..WINDOWS..System32..svchost.exe
C:..WINDOWS..system32..svchost.exe
C:..Program Files..Lavasoft..Ad-Aware..aawservice.exe
C:..WINDOWS..Explorer.EXE
C:..WINDOWS..system32..spoolsv.exe
C:..WINDOWS..system32..hkcmd.exe
C:..WINDOWS..MMKeybd.exe
C:..PROGRA~1..Logitech..SYSTEM..EM_EXEC.EXE
C:..PROGRA~1..Grisoft..AVGFRE~1..avgcc.exe
C:..Program Files..Java..jre1.5.0_08..bin..jusched.exe
C:..Program Files..Netropa..OSD.exe
C:..Program Files..AT&T..Internet Security Wizard..ISW.exe
C:..Program Files..Bellsouth..HelpCenter40b..bin..sprtcmd.exe
C:..Program Files..iTunes..iTunesHelper.exe
C:..WINDOWS..Nhksrv.exe
C:..Program Files..MySpace..IM..MySpaceIM.exe
C:..WINDOWS..system32..ctfmon.exe
C:..Program Files..Common Files..Apple..Mobile Device Support..bin..AppleMobileDeviceService.exe
C:..PROGRA~1..Grisoft..AVGFRE~1..avgamsvr.exe
C:..PROGRA~1..Grisoft..AVGFRE~1..avgupsvc.exe
C:..PROGRA~1..Grisoft..AVGFRE~1..avgemc.exe
C:..Program Files..Bonjour..mDNSResponder.exe
C:..Program Files..Common Files..Motive..McciCMService.exe
C:..WINDOWS..System32..svchost.exe
C:..Program Files..Viewpoint..Common..ViewpointService.exe
C:..Program Files..iPod..bin..iPodService.exe
C:..Program Files..Viewpoint..Viewpoint Manager..ViewMgr.exe
C:..WINDOWS..system32..wuauclt.exe
C:..Program Files..MySpace..IM..MySpaceIM.exe
C:..Program Files..Java..jre1.5.0_08..bin..jucheck.exe
C:..PROGRA~1..Grisoft..AVGFRE~1..avgwb.dat
C:..Program Files..Trend Micro..HijackThis..HijackThis.exe

R1 - HKCU..Software..Microsoft..Internet Explorer..Main,Search Page = http://g. msn. com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU..Software..Microsoft..Internet Explorer..Main,Start Page = http://my. att. net
R1 - HKLM..Software..Microsoft..Internet Explorer..Main,Default_Page_URL = http://go. microsoft. com/fwlink/?LinkId=69157
R1 - HKLM..Software..Microsoft..Internet Explorer..Main,Default_Search_URL = http://go. microsoft. com/fwlink/?LinkId=54896
R1 - HKLM..Software..Microsoft..Internet Explorer..Main,Search Page = http://go. microsoft. com/fwlink/?LinkId=54896
R0 - HKLM..Software..Microsoft..Internet Explorer..Main,Start Page = http://go. microsoft. com/fwlink/?LinkId=69157
R0 - HKLM..Software..Microsoft..Internet Explorer..Search,SearchAssistant = http://resultsmaster. com/SmartOffers/Services/resultsmaster/ResultsMasterHomeLeft
Pane. htm
R1 - HKCU..Software..Microsoft..Internet Explorer..SearchURL,(Default) = http://g. msn. com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU..Software..Microsoft..Windows..CurrentVersion..Internet
Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:..Program Files..Common Files..Adobe..Acrobat..ActiveX..AcroIEHelper.dll
O2 - BHO: &Research - {0B014B81-4E12-46F9-806F-55867AF8FD3C} - C:..WINDOWS..system32..winsystems.dll
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:..Program Files..Webtools..webtools.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:..Program Files..Java..jre1.5.0_08..bin..ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:..Program Files..Google..Google Toolbar..GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:..Program Files..Google..GoogleToolbarNotifier..5.0.926.3450..swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:..Program Files..Google..Google Toolbar..Component..fastsearch_219B3E1547538286.dll
O3 - Toolbar: (no name) - {9FB3908C-6565-4CB0-95F8-E9F85258723C} - (no file)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:..Program Files..Google..Google Toolbar..GoogleToolbar.dll
O4 - HKLM......Run: [IgfxTray] C:..WINDOWS..system32..igfxtray.exe
O4 - HKLM......Run: [HotKeysCmds] C:..WINDOWS..system32..hkcmd.exe
O4 - HKLM......Run: [DellTouch] C:..WINDOWS..MMKeybd.exe
O4 - HKLM......Run: [EM_EXEC] C:..PROGRA~1..Logitech..SYSTEM..EM_EXEC.EXE
O4 - HKLM......Run: [AVG7_CC] C:..PROGRA~1..Grisoft..AVGFRE~1..avgcc.exe /STARTUP
O4 - HKLM......Run: [IPHSend] C:..Program Files..Common Files..AOL..IPHSend..IPHSend.exe
O4 - HKLM......Run: [SunJavaUpdateSched] "C:..Program Files..Java..jre1.5.0_08..bin..jusched.exe"
O4 - HKLM......Run: [ProfileWatcher] C:..Program Files..ProfileWatcher..profilewatcher.exe
O4 - HKLM......Run: [SDR6_Check] "C:..Program Files..Common Files..DriveCleaner Free..udcsdr.exe"
O4 - HKLM......Run: [PAS_Check] "C:..Program Files..Common Files..DriveCleaner Free..udcpas.exe"
O4 - HKLM......Run: [KernelFaultCheck] %systemroot%..system32..dumprep 0 -k
O4 - HKLM......Run: [Adobe Reader Speed Launcher] "C:..Program Files..Adobe..Reader 8.0..Reader..Reader_sl.exe"
O4 - HKLM......Run: [ISW.exe] "C:..Program Files..AT&T..Internet Security Wizard..ISW.exe" /AUTORUN
O4 - HKLM......Run: [HelpCenter4.1] C:..Program Files..Bellsouth..HelpCenter40b..bin..sprtcmd.exe /P HelpCenter4.1
O4 - HKLM......Run: [QuickTime Task] "C:..Program Files..QuickTime..QTTask.exe" -atboottime
O4 - HKLM......Run: [iTunesHelper] "C:..Program Files..iTunes..iTunesHelper.exe"
O4 - HKCU......Run: [MySpaceIM] C:..Program Files..MySpace..IM..MySpaceIM.exe
O4 - HKCU......Run: [ctfmon.exe] C:..WINDOWS..system32..ctfmon.exe
O4 - HKCU......Run: [MsnMsgr] "C:..Program Files..MSN Messenger..MsnMsgr.Exe" /background
O4 - HKCU......Run: [GetModule29] C:..Program Files..GetModule..GetModule29.exe
O4 - HKCU......Run: [78642331366494082346418562388856] C:..Program Files..Antivirus 2009..av360.exe
O4 - HKUS..S-1-5-19......Run: [AVG7_Run] C:..PROGRA~1..Grisoft..AVGFRE~1..avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS..S-1-5-20......Run: [AVG7_Run] C:..PROGRA~1..Grisoft..AVGFRE~1..avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS..S-1-5-18......Run: [AVG7_Run] C:..PROGRA~1..Grisoft..AVGFRE~1..avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS...DEFAULT......Run: [AVG7_Run] C:..PROGRA~1..Grisoft..AVGFRE~1..avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar Search - c:..program files..aol..aim toolbar 5.0..resources..en-US..local..search.html
O8 - Extra context menu item: &Search - http://edits. mywebsearch. com/toolbaredits/menusearch. jhtml?p=ZKxdm011YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:..WINDOWS..System32..msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:..WINDOWS..System32..msjava.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:..WINDOWS..Network Diagnostic..xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:..WINDOWS..Network Diagnostic..xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:..Program Files..Messenger..msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:..Program Files..Messenger..msmsgs.exe
O16 - DPF: {01111E00-3E00-11D2-8470-0060089874ED} (Support. com SmartIssue) - http://support. fastaccess. com/sdccommon/download/tgctlsi. cab
O16 - DPF: {01112B00-3E00-11D2-8470-0060089874ED} (Support. com RemoteControl Class) - http://support. fastaccess. com/sdccommon/download/tgrc. cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support. com Configuration Class) - http://help. bellsouth. net/sdccommon/download/tgctlcm. cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup. msn. com/pages/MsnInstC. cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak. exe. imgfarm. com/images/nocache/funwebproducts/ei/WebfettiInitialSetup1. 0. 0. 15-3. cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www. drivecleaner. com/. freeware/installdrivecleanerstart. cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2. macromedia. com/get/shockwave/cabs/flash/swflash. cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:..Program Files..Lavasoft..Ad-Aware..aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:..Program Files..Common Files..Apple..Mobile Device Support..bin..AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:..PROGRA~1..Grisoft..AVGFRE~1..avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:..PROGRA~1..Grisoft..AVGFRE~1..avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:..PROGRA~1..Grisoft..AVGFRE~1..avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:..Program Files..Bonjour..mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:..Program Files..Google..Common..Google Updater..GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:..Program Files..iPod..bin..iPodService.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:..Program Files..Common Files..Motive..McciCMService.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:..WINDOWS..Nhksrv.exe
O23 - Service: Shell Software Detection (ShellSWDetection) - Unknown owner - C:..WINDOWS..system32..shellsw.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:..Program Files..Viewpoint..Common..ViewpointService.exe

--
End of file - 9460 bytes

[Advertisements]

can you tell me why your file paths are like this

C:..WINDOWS..Nhksrv.exe


Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum.

[Rorschach112]

can you tell me why your file paths are like this

C:..WINDOWS..Nhksrv.exe


Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum.

[roacham]

Thank you for such a fast reply. I will go over my sisters tomorrow and help her with this. I can already tell you she will have no idea why her file paths would be like that. She does not know much about computers. Is that something that is bad or does it really matter? I will let you know when I get your instuctions complete. Thanks

[Rorschach112]

No I was just curious, never seen it before

[roacham]

I went to my sisters and when I went to F8 for safe mode and pushed the keys to move the highlighted area up to safe mode it would not go. Is it ok if we run the scan while not in safe mode? I couldn't find any reason for the arrows to not move. I even tried scrolling the mouse and that wouldn't work. Nothing is locked that I could tell either. If we can't do it w/o being in safe mode maybe I can take my keyboard in case her keyboard is the problem.

[Rorschach112]

Do this instead

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

[roacham]

ComboFix 09-01-21.04 - gina 2009-01-28 13:29:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.132 [GMT -6:00]
Running from: c:\documents and settings\gina\Desktop\ComboFix.exe
AV: AVG 7.5.552 *On-access scanning enabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\gina\LOCALS~1\Temp\jewhfwje
c:\docume~1\gina\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\gina\LOCALS~1\Temp\tmp2.tmp
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\All Users\Application Data\Starware316
c:\documents and settings\All Users\Application Data\Starware316\buttons\FindIt.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\FindItHot.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\findithotxp.png
c:\documents and settings\All Users\Application Data\Starware316\buttons\finditxp.png
c:\documents and settings\All Users\Application Data\Starware316\buttons\Highlight.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\HighlightHot.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\highlighthotxp.png
c:\documents and settings\All Users\Application Data\Starware316\buttons\highlightxp.png
c:\documents and settings\All Users\Application Data\Starware316\buttons\logo.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\logoxp.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\Reference.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\ReferenceHot.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\referencehotxp.png
c:\documents and settings\All Users\Application Data\Starware316\buttons\referencexp.png
c:\documents and settings\All Users\Application Data\Starware316\buttons\screensaver.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\Screensavers0.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\Screensavers0.bmp_new
c:\documents and settings\All Users\Application Data\Starware316\buttons\Weather.bmp
c:\documents and settings\All Users\Application Data\Starware316\buttons\weatherhotxp.png
c:\documents and settings\All Users\Application Data\Starware316\buttons\weatherxp.png
c:\documents and settings\All Users\Application Data\Starware316\contexts\error.xml
c:\documents and settings\All Users\Application Data\Starware316\contexts\Related.xml
c:\documents and settings\All Users\Application Data\Starware316\contexts\Travel.xml
c:\documents and settings\All Users\Application Data\Starware316\Games\images\active\Games0.bmp
c:\documents and settings\All Users\Application Data\Starware316\Games\images\active\Games0.bmp_new
c:\documents and settings\All Users\Application Data\Starware316\images\clear.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\cloudy.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\foggy.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\mcloud.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\na.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\nclear.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\ncloudy.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\nfoggy.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\nmcloud.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\nnoicon.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\noicon.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\npcloud.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\nrain.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\pcloud.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\rain.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\shower.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\tstorm.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\walertXP.bmp
c:\documents and settings\All Users\Application Data\Starware316\images\windcloudy.bmp
c:\documents and settings\All Users\Application Data\Starware316\Movies\images\active\Movies0.bmp
c:\documents and settings\All Users\Application Data\Starware316\Movies\images\active\Movies0.bmp_new
c:\documents and settings\All Users\Application Data\Starware316\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
c:\documents and settings\All Users\Application Data\Starware316\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp_new
c:\documents and settings\All Users\Application Data\Starware316\SimpleUpdate\ProductMessagingConfig.xml
c:\documents and settings\All Users\Application Data\Starware316\SimpleUpdate\ProductMessagingConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware316\SimpleUpdate\SimpleUpdateConfig.xml
c:\documents and settings\All Users\Application Data\Starware316\SimpleUpdate\SimpleUpdateConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware316\SimpleUpdate\TimerManagerConfig.xml
c:\documents and settings\All Users\Application Data\Starware316\SimpleUpdate\TimerManagerConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware316\TemFF.tmp
c:\documents and settings\All Users\Application Data\Starware316\U001DDD72.exe
c:\documents and settings\gina\Application Data\DriveCleaner Free
c:\documents and settings\gina\Application Data\DriveCleaner Free\Logs\update.log
c:\documents and settings\gina\Application Data\gadcom
c:\documents and settings\gina\Application Data\GetModule
c:\documents and settings\gina\Application Data\GetModule\dicik.gz
c:\documents and settings\gina\Application Data\GetModule\ofadik.gz
c:\documents and settings\gina\Application Data\urlredir.cfg
c:\documents and settings\gina\err.log
c:\documents and settings\gina\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\gina\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\gina\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\Guest\Application Data\DriveCleaner Free
c:\documents and settings\Guest\Application Data\DriveCleaner Free\Logs\update.log
c:\documents and settings\Guest\Application Data\Hotbar_Icons
c:\documents and settings\Guest\Application Data\Hotbar_Icons\PCSecurityShield_32x32_1.ico
c:\documents and settings\Guest\Application Data\ShoppingReport
c:\documents and settings\Guest\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\Guest\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\Guest\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\Guest\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\Guest\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\Guest\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\Guest\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
c:\documents and settings\Guest\Application Data\Starware316
c:\documents and settings\Guest\Application Data\Starware316\BrowserSearch\BrowserSearch.xml
c:\documents and settings\Guest\Application Data\Starware316\BrowserSearch\BrowserSearch.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Configurator\Configurator.xml
c:\documents and settings\Guest\Application Data\Starware316\Configurator\Configurator.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Games\GamesOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\Games\GamesOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Layouts\ToolbarLayout.xml
c:\documents and settings\Guest\Application Data\Starware316\Layouts\ToolbarLayout.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Layouts\WeatherLayout.xml
c:\documents and settings\Guest\Application Data\Starware316\Layouts\WeatherLayout.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Manager\ManagerOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\Manager\ManagerOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Movies\MoviesOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\Movies\MoviesOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Reference\ReferenceOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\Reference\ReferenceOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Screensavers\ScreensaversOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\Screensavers\ScreensaversOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\SearchAssistPlus\SearchAssistPlusOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\SearchMatch\SearchMatchOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\SearchMatch\SearchMatchOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Tem649.tmp
c:\documents and settings\Guest\Application Data\Starware316\Toolbar\TBProductsOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\Toolbar\TBProductsOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Weather\AlertArchive.xml
c:\documents and settings\Guest\Application Data\Starware316\Weather\AlertArchive.xml.backup
c:\documents and settings\Guest\Application Data\Starware316\Weather\WeatherOptions.xml
c:\documents and settings\Guest\Application Data\Starware316\Weather\WeatherOptions.xml.backup
c:\documents and settings\Guest\Application Data\urlredir.cfg
c:\documents and settings\Guest\err.log
c:\documents and settings\Guest\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\ricky\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\surfer4life\Application Data\DriveCleaner Free
c:\documents and settings\surfer4life\Application Data\DriveCleaner Free\Logs\update.log
c:\documents and settings\surfer4life\Application Data\FunWebProducts
c:\documents and settings\surfer4life\Application Data\Hotbar_Icons
c:\documents and settings\surfer4life\Application Data\Hotbar_Icons\Software_Online_8.ico
c:\documents and settings\surfer4life\Application Data\ShoppingReport
c:\documents and settings\surfer4life\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\surfer4life\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\surfer4life\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\surfer4life\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\surfer4life\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\surfer4life\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\surfer4life\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
c:\documents and settings\surfer4life\Application Data\Starware316
c:\documents and settings\surfer4life\Application Data\Starware316\BrowserSearch\BrowserSearch.xml
c:\documents and settings\surfer4life\Application Data\Starware316\BrowserSearch\BrowserSearch.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Configurator\Configurator.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Configurator\Configurator.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Games\GamesOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Games\GamesOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Layouts\PitchLayout.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Layouts\PitchLayout.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Layouts\ToolbarLayout.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Layouts\ToolbarLayout.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Manager\ManagerOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Manager\ManagerOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Movies\MoviesOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Movies\MoviesOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Reference\ReferenceOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Reference\ReferenceOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Screensavers\ScreensaversOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Screensavers\ScreensaversOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\SearchAssistPlus\SearchAssistPlusOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\SearchMatch\SearchMatchOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\SearchMatch\SearchMatchOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Toolbar\TBProductsOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Toolbar\TBProductsOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\Starware316\Weather\AlertArchive.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Weather\WeatherOptions.xml
c:\documents and settings\surfer4life\Application Data\Starware316\Weather\WeatherOptions.xml.backup
c:\documents and settings\surfer4life\Application Data\urlredir.cfg
c:\documents and settings\surfer4life\Application Data\WeatherDPA
c:\documents and settings\surfer4life\Application Data\WeatherDPA\Weather\WeatherStartup.xml
c:\documents and settings\surfer4life\err.log
c:\documents and settings\surfer4life\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\surfer4life\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\Adssite Games Collection
c:\program files\Adssite Games Collection\BattlesOfHelicopters.exe
c:\program files\Adssite Games Collection\BobAndBill.exe
c:\program files\Adssite Games Collection\CrazyBlocks.exe
c:\program files\Adssite Games Collection\Lines.exe
c:\program files\Adssite Games Collection\uninstall.exe
c:\program files\Adssite Games Collection\VideoPool.exe
c:\program files\Antivirus 2009
c:\program files\GetModule
c:\program files\iCheck
c:\program files\iCheck\Uninstall.exe
c:\program files\inetget2
c:\program files\INSTALL.LOG
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\History\search
c:\windows\system32\ieupdates.exe
c:\windows\system32\wpv921227390376.cpx
c:\windows\wiaserviv.log

----- BITS: Possible infected sites -----

[Rorschach112]

can you attach the log, some of it is missing

[roacham]

sorry, I tried to walk her through this over the phone. I will try to go over there tomorrow and do it for her.

[Rorschach112]

ok no problem

[roacham]

ComboFix 09-01-21.04 - gina 2009-01-29 15:09:21.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.115 [GMT -6:00]
Running from: c:\documents and settings\gina\Desktop\ComboFix.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-29 )))))))))))))))))))))))))))))))
.

2009-01-23 14:55 . 2009-01-23 14:55 <DIR> d-------- c:\program files\Trend Micro
2009-01-11 19:59 . 2004-08-04 06:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2009-01-11 19:58 . 2004-08-04 06:00 180,770 --a--c--- c:\windows\system32\dllcache\c_20932.nls
2008-12-29 14:41 . 2008-12-29 14:41 <DIR> d-------- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-29 14:00 --------- d-----w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-28 18:11 --------- d-----w c:\documents and settings\gina\Application Data\AVG7
2009-01-10 16:51 --------- d-----w c:\program files\Google
2008-12-23 23:36 --------- d-----w c:\program files\iTunes
2008-12-23 23:36 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-23 23:35 --------- d-----w c:\program files\iPod
2008-12-23 23:33 --------- d-----w c:\program files\QuickTime
2008-12-17 22:37 --------- d-----w c:\program files\Apple Software Update
2008-12-13 16:03 --------- d-----w c:\documents and settings\Guest\Application Data\W Photo Studio Viewer
2008-12-11 22:06 --------- d-----w c:\program files\Webtools
2008-12-11 22:06 --------- d-----w c:\program files\MSN Messenger
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
.

((((((((((((((((((((((((((((( snapshot@2009-01-28_13.44.49.67 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-28 19:05:28 242,834 ----a-w c:\windows\system32\perfc009.dat
+ 2009-01-29 01:31:00 243,322 ----a-w c:\windows\system32\perfc009.dat
- 2009-01-28 19:05:28 845,640 ----a-w c:\windows\system32\perfh009.dat
+ 2009-01-29 01:31:00 846,896 ----a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-12-18 8720384]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-02-10 118784]
"DellTouch"="c:\windows\MMKeybd.exe" [2002-01-16 163840]
"EM_EXEC"="c:\progra~1\Logitech\SYSTEM\EM_EXEC.EXE" [2002-05-24 28672]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-17 590848]
"IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_08\bin\jusched.exe" [2006-07-26 49263]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ISW.exe"="c:\program files\AT&T\Internet Security Wizard\ISW.exe" [2007-05-03 2061816]
"HelpCenter4.1"="c:\program files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe" [2007-06-28 198184]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-27 219136]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-12-18 8720384]

c:\documents and settings\surfer4life\Start Menu\Programs\Startup\
Eyetide Launcher.lnk - c:\program files\Eyetide Media\Eyetide Viewer\EyetideController.exe [2006-09-19 831488]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1156801106\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1156801106\\ee\\aim6.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Guest\\Application Data\\MySpace\\IM\\bin\\MySpaceIM.exe"=
"c:\\Program Files\\LimeWire\\New Folder\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\att-nap\\McciBrowser.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

R3 Msikbd2k;DellTouch;c:\windows\system32\drivers\Msikbd2k.sys [2006-08-09 6656]
R3 qic157;qic157;c:\windows\system32\drivers\qic157.sys [2003-10-15 6016]
R4 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [2006-08-09 28672]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-10 24652]
.
Contents of the 'Scheduled Tasks' folder

2009-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.att.net
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
IE: &Search - http://edits.mywebse...?p=ZKxdm011YYUS
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-29 15:13:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\docume~1\gina\LOCALS~1\Temp\Perflib_Perfdata_580.dat

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2009-01-29 15:16:41
ComboFix-quarantined-files.txt 2009-01-29 21:16:12
ComboFix2.txt 2009-01-28 19:46:00

Pre-Run: 60,756,799,488 bytes free
Post-Run: 60,946,558,976 bytes free

115 --- E O F --- 2009-01-14 09:06:43

[roacham]

OK, I had her on phone and this is the scan she got today. She selected all and copied it so hopefully this is what you need.

[Rorschach112]

looking good

Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.




Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

[roacham]

This is the Malware bytes log. tomorrow I will do the Kaspersky log.








Malwarebytes' Anti-Malware 1.33
Database version: 1705
Windows 5.1.2600 Service Pack 2

1/29/2009 6:26:03 PM
mbam-log-2009-01-29 (18-26-03).txt

Scan type: Quick Scan
Objects scanned: 58695
Time elapsed: 15 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 10
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a21-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bfc08cff-c737-4433-bd5a-0ee7efcfee54} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls\wxfw.dll (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Webtools (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\WhoisCL.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsystems.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\surfer4life\Desktop\Find And Fix Errors.lnk (Rogue.Link) -> Quarantined and deleted successfully.

[Rorschach112]

post a new HJT Log with it