[olsalesd]

and here are my infected files from the scan...

File C:\PROGRA~1\DAILYW~1\weather.exe infected by "Trojan-Downloader.Win32.Centim.an" Virus. Action Taken: File Deleted.
File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\system32\cmcfg323.exe tagged as not-a-virus:AdWare.IEDriver.a. No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy.zip infected by "Password-protected-EXE" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ExactAdvertisingBargainsBuddy7.zip infected by "Password-protected-EXE" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3c936701-33066763.zip infected by "Trojan.Java.OpenStream.w" Virus. Action Taken: File Deleted.
File C:\Dynamix\TRIBES\tribes_1-10_to_1-105.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\002C1CF1.exe infected by "Trojan-Downloader.Win32.IstBar.je" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\04494DDE.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\056B368A.cla infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16BC6D33.exe infected by "Trojan-Downloader.Win32.Small.alr" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16BF1730.exe infected by "Trojan-Downloader.Win32.Small.alr" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16C3412C.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16C66B29.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16C91525.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16CD3F21.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16D0691E.exe infected by "Trojan-Downloader.Win32.Small.alr" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16D3131A.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16D63D17.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\187D0C13.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\1D0771A4.dll tagged as not-a-virus:[bleep]-Dialer.Win32.DialWeb. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\1D0771A4.exe tagged as not-a-virus:AdWare.WinFetcher.b. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\21850E59.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\227A6168.class infected by "Trojan.Java.ClassLoader.Dummy.a" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2BC115A7.exe infected by "Virus.Win32.HLLP.Savno" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\2CCC75FA.exe infected by "P2P-Worm.Win32.Krepper.c" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2F2B775E.exe infected by "P2P-Worm.Win32.Krepper.c" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\33715C31.exe infected by "Backdoor.Win32.Spyboter.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\38A60656.exe infected by "Trojan-Downloader.Win32.Small.alr" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\392F7AD4.class infected by "Trojan-Downloader.Java.OpenConnection.v" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\39D2069B.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\39D53097.DLL tagged as not-a-virus:AdWare.MediaPops.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\39D53097.exe infected by "Trojan.Win32.Septic.a" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\401E1BA8.exe tagged as not-a-virus:AdWare.MediaTickets.h. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\41CD4B42.class infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\41D1753F.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\426A2A96.class infected by "Trojan.Java.ClassLoader.h" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\48C27735.cla infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\4A95448D.exe infected by "Backdoor.Win32.Spyboter.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\4C441159.cla infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\50CD24E7.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\518436EF.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\535C1CC6.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\56974821.cla infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\584B1376.dll infected by "Trojan.Win32.Delf.gh" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\5E1A6D71.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\63AE48D3.exe infected by "Exploit.Win32.Ais.20" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\64215A9F.exe infected by "DoS.Win32.BKill.b" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\64761E41.exe infected by "DoS.Win32.BKill.b" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\64C579BC.exe tagged as not-a-virus:AdWare.MDH.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\64C823B8.exe tagged as not-a-virus:AdWare.MDH.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\64CF77B1.exe tagged as not-a-virus:AdWare.PurityScan.w. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\64D221AD.EXE infected by "Trojan-Dropper.Win32.Small.ht" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\674D6C58.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\689242BE.exe infected by "Trojan-Downloader.Win32.IstBar.ij" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\689816B7.dll infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\689816B7.exe infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\689C40B3.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\68A52EEC.exe tagged as not-a-virus:AdWare.TotalVelocity.v. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\723A2348.class infected by "Trojan.Java.ClassLoader.d" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\76EA5329.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\76F02722.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\76F3511E.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\76F77B1B.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\76FA2517.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\76FD4F14.dll infected by "Trojan-Downloader.Win32.IstBar.ik" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\77007910.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\7704230C.exe infected by "Trojan-Downloader.Win32.IstBar.je" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\770A7705.exe infected by "Trojan-Downloader.Win32.IstBar.jd" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\770D2102.exe infected by "Trojan-Downloader.Win32.IstBar.jd" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\780160C0.exe infected by "Exploit.Win32.Ais.20" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\78DB41FA.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP1\A0000005.exe infected by "not-virus:Hoax.Win32.Renos.a" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP1\A0000073.exe infected by "not-virus:Hoax.Win32.Renos.a" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP1\A0000233.dll infected by "Trojan.Win32.TalkStocks.a" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP1\A0000234.exe infected by "not-virus:Hoax.Win32.Renos.a" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP13\A0001978.exe infected by "not-virus:Hoax.Win32.Renos.a" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003150.exe infected by "Trojan-Downloader.Win32.Centim.an" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003151.exe infected by "Trojan-Downloader.Win32.IstBar.je" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003152.exe infected by "Trojan-Downloader.Win32.Small.alr" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003153.exe infected by "Trojan-Downloader.Win32.Small.alr" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003154.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003155.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003156.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003157.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003158.exe infected by "Trojan-Downloader.Win32.Small.alr" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003159.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003160.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003161.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003162.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003163.exe infected by "Virus.Win32.HLLP.Savno" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003164.exe infected by "P2P-Worm.Win32.Krepper.c" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003165.exe infected by "P2P-Worm.Win32.Krepper.c" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003166.exe infected by "Backdoor.Win32.Spyboter.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003167.exe infected by "Trojan-Downloader.Win32.Small.alr" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003168.exe infected by "Trojan.Win32.Septic.a" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003169.exe infected by "Backdoor.Win32.Spyboter.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003170.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003171.dll infected by "Trojan.Win32.Delf.gh" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003172.exe infected by "Exploit.Win32.Ais.20" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003173.exe infected by "DoS.Win32.BKill.b" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003174.exe infected by "DoS.Win32.BKill.b" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003175.EXE infected by "Trojan-Dropper.Win32.Small.ht" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003176.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003177.exe infected by "Trojan-Downloader.Win32.IstBar.ij" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003178.dll infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003179.exe infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003180.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003181.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003182.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003183.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003184.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003185.dll infected by "Trojan-Downloader.Win32.IstBar.ik" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003186.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003187.exe infected by "Trojan-Downloader.Win32.IstBar.je" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003188.exe infected by "Trojan-Downloader.Win32.IstBar.jd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003189.exe infected by "Trojan-Downloader.Win32.IstBar.jd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003190.exe infected by "Exploit.Win32.Ais.20" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{1ABD4E2E-E999-49FE-9BEA-52E79D144351}\RP21\A0003191.exe infected by "Trojan.Win32.P2E.br" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\cmcfg323.exe tagged as not-a-virus:AdWare.IEDriver.a. No Action Taken.
File C:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

[Advertisements]

Is that the entire infected items list or did some of it get cut off?

Do you know what these are:

C:\Dynamix\TRIBES\tribes_1-10_to_1-105.exe

Please open Norton click on "View Reports" open the qurantine folder and delete everything quarantined in there.

Open SpyBot and delete everything is has quarantined.

We will clear restore points once your system is clean to get rid of those files hiding out in System Restore.

Delete the following in bold:

C:\Program Files\Daily Weather Forecast <-Folder
C:\WINDOWS\system32\cmcfg323.exe <-File
C:\WINDOWS\_MSRSTRT.EXE <-File

Then we need to clear out any Java viruses (which may be why you can't use IE for some online scanners!):

1. Click Start > Control Panel.

2. Double-click the Java icon (coffee cup) in the control panel. (If it says "Java Plug-in" under the icon please find the update tab in the Java control panel. Update your Java, reboot, and then follow the rest of the instructions.)

3. Under Temporary Internet Files, click the Delete Files button.

There are three options on this window to clear the cache - leave ALL 3 checked.
1. Downloaded Applets
2. Downloaded Applications
3. Other Files

4. Click OK on Delete Temporary Files window.
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

5. Click OK to leave the Java Control Panel.

Run HiJackThis. Place a check next to the following item and click FIX CHECKED:

O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe

Close HiJackThis.

I lied. There is another program I want you to run - I just found out about it tonight

Please download Trend Micro™ Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button).

• Save it to your desktop.
• Double-click the new icon on your desktop (tmas-web-scan.exe)
• It will say "Loading TrendMicro definitions".
• Once the definitions are loaded, the program will appear to close then re-open.
• Click "Start Scan"
• After it's done scanning, click "Scan Results"
• Make sure all items found have a check next to them, then click "Clean Threats Now".
• Click Exit.

Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them here.

[Michelle]

Is that the entire infected items list or did some of it get cut off?

Do you know what these are:

C:\Dynamix\TRIBES\tribes_1-10_to_1-105.exe

Please open Norton click on "View Reports" open the qurantine folder and delete everything quarantined in there.

Open SpyBot and delete everything is has quarantined.

We will clear restore points once your system is clean to get rid of those files hiding out in System Restore.

Delete the following in bold:

C:\Program Files\Daily Weather Forecast <-Folder
C:\WINDOWS\system32\cmcfg323.exe <-File
C:\WINDOWS\_MSRSTRT.EXE <-File

Then we need to clear out any Java viruses (which may be why you can't use IE for some online scanners!):

1. Click Start > Control Panel.

2. Double-click the Java icon (coffee cup) in the control panel. (If it says "Java Plug-in" under the icon please find the update tab in the Java control panel. Update your Java, reboot, and then follow the rest of the instructions.)

3. Under Temporary Internet Files, click the Delete Files button.

There are three options on this window to clear the cache - leave ALL 3 checked.
1. Downloaded Applets
2. Downloaded Applications
3. Other Files

4. Click OK on Delete Temporary Files window.
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

5. Click OK to leave the Java Control Panel.

Run HiJackThis. Place a check next to the following item and click FIX CHECKED:

O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe

Close HiJackThis.

I lied. There is another program I want you to run - I just found out about it tonight

Please download Trend Micro™ Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button).

• Save it to your desktop.
• Double-click the new icon on your desktop (tmas-web-scan.exe)
• It will say "Loading TrendMicro definitions".
• Once the definitions are loaded, the program will appear to close then re-open.
• Click "Start Scan"
• After it's done scanning, click "Scan Results"
• Make sure all items found have a check next to them, then click "Clean Threats Now".
• Click Exit.

Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them here.

[olsalesd]

Did everything you said in the last post except, delete the quarantined files in spybot (because I couldnt figure out how), and then I didnt run the last scan you said because I wasnt sure if I should have without deleted the spy bot quarantined files...I didn't want to mess anything up!

[Michelle]

Delete the following zipped folder (in bold):

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ExactAdvertisingBargainsBuddy7.zip

Then, I need to know what this is if you know:
C:\Dynamix\TRIBES\tribes_1-10_to_1-105.exe

Then please run the scan

Edited by bananafanafo, 06 July 2005 - 01:43 AM.

[olsalesd]

Ok, I deleted that file. And that file you were wondering what it was, I used to play a computer game named "Tribes." That was one of the files to update the game. However, I unistalled this game long ago and never deleted the tribes folder, until you reminded me of it! Now its gone...and I will run the scan overnight tonight.

[olsalesd]

Here ya go....




Started Scanning
Internet Cookies
Found 'dist.belnk.com' in 'Internet Explorer Cache'
Found 'realmedia.com' in 'Internet Explorer Cache'
Found '2o7.net' in 'Internet Explorer Cache'
Found 'belnk.com' in 'Internet Explorer Cache'
Found 'trafficmp.com' in 'Internet Explorer Cache'
Found 'atwola.com' in 'Internet Explorer Cache'
Found 'tradedoubler.com' in 'Internet Explorer Cache'
Programs in Memory
Windows Registry
Found '' in 'SOFTWARE\LimeWire'
Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}'
Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}'
Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}'
Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}'
Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}'
Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}'
Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}'
Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}'
Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}'
Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}'
Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}'
Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}'
Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}'
Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}'
Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}'
Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}'
Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\TypeLib'
Found '' in 'SOFTWARE\Classes\JCDE_Stack.1'
Found '' in 'SOFTWARE\TrayNotifier'
Found '' in 'SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32'
Found '' in 'SOFTWARE\Magnet'
Found '' in 'SOFTWARE\Magnet\Handlers\Kazaa'
Found '' in 'SOFTWARE\Magnet\Handlers\Kazaa\Type'
Found '' in 'SOFTWARE\Classes\magnet'
Found '' in 'SOFTWARE\Classes\magnet\shell\open\command'
Found '' in 'Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\GAIN Publishing'
Found '' in 'SOFTWARE\Classes\Interface\{8A94C367-815A-4D4F-A6B6-D4EB877A126C}'
Found '' in 'SOFTWARE\Classes\Interface\{8A94C367-815A-4D4F-A6B6-D4EB877A126C}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{8A94C367-815A-4D4F-A6B6-D4EB877A126C}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{8A94C367-815A-4D4F-A6B6-D4EB877A126C}\TypeLib'
Found '' in 'SOFTWARE\Classes\TypeLib\{CED445E2-8C78-4F40-87D7-F7FB6F1B6791}\1.0'
Found '' in 'SOFTWARE\Classes\TypeLib\{CED445E2-8C78-4F40-87D7-F7FB6F1B6791}\1.0\0\win32'
Found '' in 'SOFTWARE\Classes\TypeLib\{CED445E2-8C78-4F40-87D7-F7FB6F1B6791}\1.0\FLAGS'
Found '' in 'SOFTWARE\Classes\TypeLib\{CED445E2-8C78-4F40-87D7-F7FB6F1B6791}\1.0\HELPDIR'
Found 'URL Protocol' in 'SOFTWARE\Classes\magnet'
Found '' in 'Software\AppConf'
Found 'confset' in 'Software\AppConf'
Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1'
Found '' in 'SOFTWARE\Classes\TypeLib\{CED445E2-8C78-4F40-87D7-F7FB6F1B6791}'
Found '' in 'SOFTWARE\Classes\TypeLib\{CED445E2-8C78-4F40-87D7-F7FB6F1B6791}\1.0\0'
Found '' in 'SOFTWARE\Classes\Interface\{D273D427-57C6-4B12-860F-BBB8195F6E2A}'
Found '' in 'SOFTWARE\Classes\Interface\{370F6327-41C4-4FA6-A2DF-1BA57EE0FBB9}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{370F6327-41C4-4FA6-A2DF-1BA57EE0FBB9}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{370F6327-41C4-4FA6-A2DF-1BA57EE0FBB9}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{370F6327-41C4-4FA6-A2DF-1BA57EE0FBB9}'
Found '' in 'SOFTWARE\Classes\Interface\{EFA52460-8822-4191-BA38-FACDD2007910}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{EFA52460-8822-4191-BA38-FACDD2007910}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{EFA52460-8822-4191-BA38-FACDD2007910}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{EFA52460-8822-4191-BA38-FACDD2007910}'
Found 'conc' in 'Software\Microsoft\Internet Explorer\Main'
Found '' in 'SOFTWARE\Desktop'
Found '' in 'Interface\{851F86C9-D3CC-4574-93F5-40E2D65159E4}'
Found '' in 'SOFTWARE\Classes\Interface\{851F86C9-D3CC-4574-93F5-40E2D65159E4}'
Found '' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run'
Internet URL Shortcuts
Files and Directories
Found 'LimeWire20.dll' in 'C:\Program Files\LimeWire'
Found 'WildApp.inf' in 'C:\WINDOWS\Downloaded Program Files'
Found 'sepsd.bin' in 'C:\WINDOWS'
Found 'P2P Networking v124.cpl' in 'C:\WINDOWS\system32'
Finished Scanning
Started Backup
Finished Backup
Started Cleaning
Checking for 'C:\Program Files\LimeWire\LimeWire20.dll' in shortcut areas.
Checking for 'C:\Program Files\LimeWire\LimeWire20.dll' in startup areas.
Cleaning 'C:\Program Files\LimeWire\LimeWire20.dll'
Checking for 'C:\WINDOWS\Downloaded Program Files\WildApp.inf' in shortcut areas.
Checking for 'C:\WINDOWS\Downloaded Program Files\WildApp.inf' in startup areas.
Cleaning 'C:\WINDOWS\Downloaded Program Files\WildApp.inf'
Checking for 'C:\WINDOWS\sepsd.bin' in shortcut areas.
Checking for 'C:\WINDOWS\sepsd.bin' in startup areas.
Cleaning 'C:\WINDOWS\sepsd.bin'
Checking for 'C:\WINDOWS\system32\P2P Networking v124.cpl' in shortcut areas.
Checking for 'C:\WINDOWS\system32\P2P Networking v124.cpl' in startup areas.
Cleaning 'C:\WINDOWS\system32\P2P Networking v124.cpl'
Finished Cleaning

[Michelle]

What kind of problems are you having now?

[olsalesd]

What do you mean what kind of problems....? The biggest one right now is how there is no log off option on the start menu. I can't remember what program it was I uninstalled, but I dont even know if that had anything to do with it...it was just at about the same time I uninstalled that program that my log off button dissapeared.

[Michelle]

What do you mean what kind of problems....?

That's exactly what I mean. I'm not on your computer, so you have to tell me what kind of problems you're having...

Ok, no log-off button and what else?

[Michelle]

Go to Start > Run - paste this in the box:

regedit /e c:\deskpol.txt HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

Click OK.

Then:
Go to Start > Run paste this in the box:

regedit /e c:\deskpol2.txt HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies

Click OK.

Now, please navigate to C:\deskpol.txt and C:\deskpol2.txt and open each one and copy and paste the text inside here.

Edited by bananafanafo, 07 July 2005 - 12:06 PM.

[olsalesd]

Here is what was inside deskpol.txt :

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallpaper"=dword:00000000
"NoComponents"=dword:00000000
"NoAddingComponents"=dword:00000000
"NoDeletingComponents"=dword:00000000
"NoEditingComponents"=dword:00000000
"NoHTMLWallPaper"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=hex:91,00,00,00
"StartMenuLogOff"=dword:00000001
"NoActiveDesktop"=dword:00000000
"ClassicShell"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DontDisplayLastUserName"=dword:00000000

[olsalesd]

And here is what was in deskpol2.txt :

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum]
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"=dword:00000001
"{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}"=dword:40000021
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"=dword:00000020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"verbosestatus"=dword:00000000

[Michelle]

And I found your problem - no it was not due to uninstalling a program. Someone set a restriction that hid the button.

Copy everything in the code box below (starting with REGEDIT4) and paste it into notepad. Go to "File > Save As...", then click the drop-down box to change the "Save As Type" to "All Files". Save it as fixlog.reg on your desktop.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"StartMenuLogOff"=-

Double-click fixlog.reg on your desktop. When asked if you want to merge with the registry click YES. Reboot your computer and your log-off button will be back

Edited by bananafanafo, 07 July 2005 - 12:36 PM.

[olsalesd]

Sure enough, my log off command is back! Thanks! Now, let me think if their are any other problems I've been noticing....

By the way, can I now delete the fixlog.reg file I created?

Oh I have a question.... Alright, I know there are soo many different virus, spyware, adware, scanners out there....I have my lineup that I usually run (all in one day, once a week) and I thought they were good...until I got this virus...So I'm just wondering what is a good lineup of scanners to keep my computer clean for the most part?

[Michelle]

By the way, can I now delete the fixlog.reg file I created?

Yes

Oh I have a question.... Alright, I know there are soo many different virus, spyware, adware, scanners out there....I have my lineup that I usually run (all in one day, once a week) and I thought they were good...until I got this virus...So I'm just wondering what is a good lineup of scanners to keep my computer clean for the most part?

I will give you a list of my recommendations once we're done cleaning your computer

Let me know any your problems you're having (if any...) then we will proceed.