[Tony_Woodhead]

Hi,

Can you help with this log? I have used adaware, and an anti virus. Spybot S&D can't delete DyfuCa Internet optimiser and hijackThis and regedit won't stay open unless I change their name. I installed XP professional from scratch last week and got infected before I could download SP1a (which is now installed). I don't want to install sp2 until I have a clean system again.

Logfile of HijackThis v1.99.1
Scan saved at 00:30:36, on 07/05/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\System32\libsysmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\System32\cioman32.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\excel.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
C:\Program Files\Adobe\Illustrator 8.0\Illustrator.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Program Files\hijackthis\thishjk.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: IE SP2 AddOn - {B1241EB1-F5E2-4189-A992-2547D2DC2A78} - C:\WINDOWS\System32\sponj.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [do4sRgj7j] cioman32.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1115247924091
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{7950C273-B969-427C-B60B-26EAD8291F46}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9ACB504-9565-4BCC-A124-3F53A2363ABA}: NameServer = 69.50.184.86 195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{E562B0FD-44EA-4EF1-A66C-46AD88C44033}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe
O23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

You guys perform a great service. Thanks

TW!

[Advertisements]

Welcome to GTG.

Are you sure SP1 is installed? According to the log, you have no Service Packs installed at all.

For the Dyfuca detected by Spybot, what is the registry location? If possible, give us a log from the Spybot scan.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro http://uk.trendmicro...call_launch.php. Just follow the instructions on the site to run the online scan. If any viruses/trojans are detected, try to delete or clean them in that site. You may use Panda ActiveScan also at http://www.pandasoft...ucts/activescan. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

Reboot into Safe Mode by hitting the F8 key until menu shows up. In some systems, this may be the F5 key, so try that if F8 doesn't work.
Go to Start->Run and type in services.msc and hit OK. Then look for NT login service (ntlogin32) and double click on it. Click on the Stop button and under Startup type, choose Disabled. Do the same thing for Hardware Clock Driver (hwclock).

Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click 'Kill process' for each one if they are still listed (they shouldn't be - but double check):

C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\System32\libsysmgr.exe
C:\WINDOWS\System32\cioman32.exe

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe
O2 - BHO: IE SP2 AddOn - {B1241EB1-F5E2-4189-A992-2547D2DC2A78} - C:\WINDOWS\System32\sponj.dll
O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe
O4 - HKCU\..\Run: [do4sRgj7j] cioman32.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{7950C273-B969-427C-B60B-26EAD8291F46}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9ACB504-9565-4BCC-A124-3F53A2363ABA}: NameServer = 69.50.184.86 195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{E562B0FD-44EA-4EF1-A66C-46AD88C44033}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe
O23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\System32\libsysmgr.exe
C:\WINDOWS\System32\cioman32.exe
c:\windows\system32\userinit32.exe - make sure it's spelled exactly as shown here
C:\WINDOWS\System32\sponj.dll
libsysmgr.exe
syslog32.exe

Reboot into Normal Mode run a new HijackThis scan. Save the log file and post it here.

[greyknight17]

Welcome to GTG.

Are you sure SP1 is installed? According to the log, you have no Service Packs installed at all.

For the Dyfuca detected by Spybot, what is the registry location? If possible, give us a log from the Spybot scan.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro http://uk.trendmicro...call_launch.php. Just follow the instructions on the site to run the online scan. If any viruses/trojans are detected, try to delete or clean them in that site. You may use Panda ActiveScan also at http://www.pandasoft...ucts/activescan. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

Reboot into Safe Mode by hitting the F8 key until menu shows up. In some systems, this may be the F5 key, so try that if F8 doesn't work.
Go to Start->Run and type in services.msc and hit OK. Then look for NT login service (ntlogin32) and double click on it. Click on the Stop button and under Startup type, choose Disabled. Do the same thing for Hardware Clock Driver (hwclock).

Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click 'Kill process' for each one if they are still listed (they shouldn't be - but double check):

C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\System32\libsysmgr.exe
C:\WINDOWS\System32\cioman32.exe

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe
O2 - BHO: IE SP2 AddOn - {B1241EB1-F5E2-4189-A992-2547D2DC2A78} - C:\WINDOWS\System32\sponj.dll
O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe
O4 - HKCU\..\Run: [do4sRgj7j] cioman32.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{7950C273-B969-427C-B60B-26EAD8291F46}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9ACB504-9565-4BCC-A124-3F53A2363ABA}: NameServer = 69.50.184.86 195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{E562B0FD-44EA-4EF1-A66C-46AD88C44033}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{0F2C69EE-1EC2-4BA2-89FC-555633BF1391}: NameServer = 69.50.184.86,195.225.176.110
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe
O23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\System32\libsysmgr.exe
C:\WINDOWS\System32\cioman32.exe
c:\windows\system32\userinit32.exe - make sure it's spelled exactly as shown here
C:\WINDOWS\System32\sponj.dll
libsysmgr.exe
syslog32.exe

Reboot into Normal Mode run a new HijackThis scan. Save the log file and post it here.

[Tony_Woodhead]

Thanks grayknight17,

Here is my new log. I can't delete userinit32.exe so I have changed its name to to32.exe. I don't know if this will do any good. As for SP1a. I have downloaded this from microsoft.com and followed all the links. I was downloading this for an hour. Do you have any suggestions?

Thanks again for you help

Logfile of HijackThis v1.99.1
Scan saved at 16:07:51, on 07/05/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\hijackthis\thishjk.exe
C:\WINDOWS\System32\wuauclt.exe

F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1115247924091
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

[Tony_Woodhead]

Also.. Spybot is showing a clean log apart from the following:

Error during check!: Xuron55 (datei C\windows\win.ini Kann nicht geoffnet werden. The process cannot access the file because it is being used by another process) ()

[greyknight17]

OK, for the Windows Update, do you have a fast internet connection? If not, I suggest ordering SP2 from Microsoft instead. It's free.

OK, you renamed it but it seems to have recreated itself. We will need to delete both of them in that case.

Download KillBox http://www.greyknigh...spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy and paste each of the following into KillBox (hitting the X button for each file - choose NO when it asks if you want to reboot):

c:\windows\system32\userinit32.exe
c:\windows\system32\to32.exe

Check and fix this in HijackThis:

F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/Cleanup.exe ) and install it. Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Restart and post a new HijackThis log and the following:

Please empty any Quarantine folder in your antivirus program and purge all recovery items in the Spybot program (if you use it) before running this tool.

Download the Mwav virus checker at http://www.mwti.net/antivirus/mwav.asp (Use Link 3)

1. Save it to a folder.
2. Reboot into Safe Mode.
3. Double click the Mwav.exe file. This is a stand alone tool and NOT just a virus checker......so it won't install anything.
4. Select all local drives, scan all files, and press SCAN. When it is completed, anything found will be displayed in the lower pane.
5. In the Virus Log Information Pane......
Left click and highlight all the information in the Lower pane --- Use &CTRL C &on your keyboard to copy everything found in the lower pane and save it to a notepad file
*Note* If prompted that a virus was found and you need to purchase the product to remove the malware, just close out the prompt and let it continue scanning. We are not going to use this to remove anything...but to ID the bad files.

Once you copy that to a Notepad file...highlight the text and copy it here.

[Tony_Woodhead]

OK, here it is...

Logfile of HijackThis v1.99.1
Scan saved at 23:02:36, on 08/05/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\hijackthis\thishjk.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1115247924091
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

and here is the Mwav report:

{\rtf1\ansi\ansicpg1252\uc1 \deff0\deflang1033\deflangfe1033{\fonttbl{\f0\froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}
{\f11\fswiss\fcharset0\fprq2{\*\panose 00000000000000000000}MS Sans Serif;}{\f16\froman\fcharset238\fprq2 Times New Roman CE;}{\f17\froman\fcharset204\fprq2 Times New Roman Cyr;}{\f19\froman\fcharset161\fprq2 Times New Roman Greek;}
{\f20\froman\fcharset162\fprq2 Times New Roman Tur;}{\f21\froman\fcharset186\fprq2 Times New Roman Baltic;}{\f22\fswiss\fcharset238\fprq2 Arial CE;}{\f23\fswiss\fcharset204\fprq2 Arial Cyr;}{\f25\fswiss\fcharset161\fprq2 Arial Greek;}
{\f26\fswiss\fcharset162\fprq2 Arial Tur;}{\f27\fswiss\fcharset186\fprq2 Arial Baltic;}}{\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;
\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0;\red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}{\stylesheet{
\nowidctlpar\widctlpar\adjustright \fs20\lang2057\cgrid \snext0 Normal;}{\*\cs10 \additive Default Paragraph Font;}}{\info{\author Administrator}{\operator Administrator}{\creatim\yr2005\mo5\dy9\hr11\min47}{\revtim\yr2005\mo5\dy9\hr11\min48}{\version2}
{\edmins1}{\nofpages3}{\nofwords2160}{\nofchars12317}{\*\company }{\nofcharsws15126}{\vern71}}\widowctrl\ftnbj\aenddoc\hyphcaps0\viewkind4\viewscale100 \fet0\sectd \linex0\headery709\footery709\colsx709\sectdefaultcl {\*\pnseclvl1
\pnucrm\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl2\pnucltr\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl3\pndec\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl4\pnlcltr\pnstart1\pnindent720\pnhang{\pntxta )}}{\*\pnseclvl5
\pndec\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl8\pnlcltr\pnstart1\pnindent720\pnhang
{\pntxtb (}{\pntxta )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}\pard\plain \nowidctlpar\adjustright \fs20\lang2057\cgrid {\f11\fs16\cgrid0 File C:\\WINDOWS\\System32\\
ie2cltr.dll infected by "not-a-virus:AdWare.ToolBar.SBSoft.h" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\mptsgsvc.exe infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File System Found infected by "SideFind Spyware/Adware" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\dumpsprep.exe infected by "Trojan-Dropper.Win32.Small.xl" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\hdvrd.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\hdwxs.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\ipdnssec6.exe infected by "Trojan.Win32.DNSChanger.n" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\mqspbkup.exe infected by "Trojan.Win32.StartPage.yc" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\qwinnta.exe infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\sesmgr.exe infected by "Trojan-Clicker.Win32.Small.fr" Virus. Action Taken: No Action Taken.
\par File C:\\Applications\\Tool\\AOL\\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
\par File C:\\Documents and Settings\\Toni\\My Documents\\99099.exe infected by "not-a-virus:AdWare.Gator.3103" Virus. Action Taken: No Action Taken.
\par File C:\\Documents and Settings\\toni.JUSTFORME\\My Documents\\Downloads\\PixelToolbox.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
\par File C:\\Program Files\\AOL 9.0\\Jiti\\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
\par File C:\\Program Files\\hijackthis\\backups\\backup-20050507-152915-766.dll infected by "Trojan.Win32.StartPage.yc" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP0\\A0000002.exe infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP0\\A0000003.EXE infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP0\\A0000004.EXE infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP2\\A0000014.exe infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP2\\A0000015.EXE infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP2\\A0000016.EXE infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP3\\A0000141.exe infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP3\\A0000142.EXE infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP3\\A0000143.EXE infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP3\\A0000154.exe infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP3\\A0000155.EXE infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP3\\A0000156.EXE infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{52B3FCF1-9308-4AFA-A07C-DF1C49794F9D\}\\RP3\\A0000173.exe infected by "Trojan.Win32.Agent.cx" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP10\\A0002407.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP10\\A0002410.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP11\\A0002505.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP12\\A0002565.exe infected by "not-a-virus:AdWare.Msnagent.a" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP12\\A0002566.dll infected by "Trojan-Downloader.Win32.Agent.hz" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP12\\A0002570.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP12\\A0002575.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP12\\A0002584.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP13\\A0002668.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP13\\A0002755.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP14\\A0002762.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP19\\A0002780.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP28\\A0002821.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP32\\A0002918.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP33\\A0002948.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0002960.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0002962.dll infected by "Trojan.Win32.StartPage.yc" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0002966.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0002977.exe infected by "Backdoor.Win32.Small.eo" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0002999.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0003002.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0003003.exe infected by "not-a-virus:AdWare.Apropos.i" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0003009.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP34\\A0003016.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP35\\A0004016.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP35\\A0004376.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP35\\A0004382.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP35\\A0004398.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP35\\A0004412.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP35\\A0004413.exe infected by "Trojan-Dropper.Win32.Juntador.e" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000833.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000837.dll infected by "not-a-virus:AdWare.AdMir.a" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000838.exe infected by "Trojan-Downloader.Win32.IstBar.ij" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000839.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000847.dll infected by "Trojan-Downloader.Win32.IstBar.ik" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000854.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000877.dll infected by "Trojan-Downloader.Win32.Apropo.w" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000879.exe infected by "not-a-virus:AdWare.Apropos.f" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000886.exe infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000887.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000888.exe infected by "Trojan-Downloader.Win32.TSUpdate.l" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0000889.exe infected by "not-a-virus:AdWare.Xupiter.m" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0001919.exe infected by "not-a-virus:AdWare.Sahat.m" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0001955.exe infected by "not-a-virus:AdWare.Xupiter.m" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0001959.exe infected by "Trojan-Downloader.Win32.TSUpdate.k" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0001960.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP6\\A0001961.exe infected by "Trojan-Downloader.Win32.TSUpdate.l" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP7\\A0002199.exe infected by "not-a-virus:AdWare.Gator.3103" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP7\\A0002343.exe infected by "not-a-virus:AdWare.WinAD.af" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP7\\A0002344.exe infected by "not-a-virus:AdWare.WinAD.af" Virus. Action Taken: No Action Taken.
\par File C:\\System Volume Information\\_restore\{6B7A6CC6-C7FC-420F-B356-817A57AE716C\}\\RP7\\A0002346.dll infected by "not-a-virus:AdWare.WiAD.af" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\config\\systemprofile\\Local Settings\\Temporary Internet Files\\Content.IE5\\8DQF4H6J\\cmctl[1].dll infected by "not-a-virus:AdWare.AdMir.a" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\config\\systemprofile\\Local Settings\\Temporary Internet Files\\Content.IE5\\8LE3G1Q3\\cxtpls_loader[1].exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\config\\systemprofile\\Local Settings\\Temporary Internet Files\\Content.IE5\\8LE3G1Q3\\targetsaver[1].exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\dumpsprep.exe infected by "Trojan-Dropper.Win32.Small.xl" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\hdvrd.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\hdwxs.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\ipdnssec6.exe infected by "Trojan.Win32.DNSChanger.n" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\mqspbkup.exe infected by "Trojan.Win32.StartPage.yc" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\qwinnta.exe infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\sesmgr.exe infected by "Trojan-Clicker.Win32.Small.fr" Virus. Action Taken: No Action Taken.
\par
\par }{\f1\cgrid0 Mon May 09 03:36:41 2005 => Total Objects Scanned: 37533
\par Mon May 09 03:36:41 2005 => Total Virus(es) Found: 89
\par Mon May 09 03:36:41 2005 => Total Disinfected Files: 0
\par Mon May 09 03:36:41 2005 => Total Files Renamed: 0
\par Mon May 09 03:36:41 2005 => Total Deleted Objects: 0
\par Mon May 09 03:36:41 2005 => Total Errors: 68
\par Mon May 09 03:36:41 2005 => Time Elapsed: 00:55:51
\par Mon May 09 03:36:41 2005 => Virus Database Date: 2005/05/05
\par Mon May 09 03:36:41 2005 => Virus Database Count: 128422}{\f1\cgrid0
\par }}

WOW. thats alot. Why dosn't my AVG see them?

TW!

[greyknight17]

Each program has it's own detection databases, so that's why some find things others don't. mwav is just a stand alone tool, you still need AVG.

OK, there's a handful here and I don't want to take my time sorting it out for you. It should be clear what files to delete. So I will just list them as it is. All you have to do is look for those files c:\windows....etc... and delete the corresponding file listed below:

C:\\WINDOWS\\system32\\mptsgsvc.exe infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\dumpsprep.exe infected by "Trojan-Dropper.Win32.Small.xl" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\hdvrd.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\hdwxs.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\ipdnssec6.exe infected by "Trojan.Win32.DNSChanger.n" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\mqspbkup.exe infected by "Trojan.Win32.StartPage.yc" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\qwinnta.exe infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\System32\\sesmgr.exe infected by "Trojan-Clicker.Win32.Small.fr" Virus. Action Taken: No Action Taken.
\par File C:\\Documents and Settings\\Toni\\My Documents\\99099.exe
C:\\WINDOWS\\system32\\hdvrd.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\hdwxs.dll infected by "HackTool.Win32.Hidd.j" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\ipdnssec6.exe infected by "Trojan.Win32.DNSChanger.n" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\mqspbkup.exe infected by "Trojan.Win32.StartPage.yc" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\qwinnta.exe infected by "Trojan-Clicker.Win32.Agent.cn" Virus. Action Taken: No Action Taken.
\par File C:\\WINDOWS\\system32\\sesmgr.exe

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer and uncheck the same box to enable System Restore.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/Cleanup.exe ) and install it. Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Restart and post back a new mwav log again.

[greyknight17]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.