[Elliott1234]

Hi,

I read a few winfixer problems posted to this site and have tried some of your suggestions but can't get rid of this thing. Two problems: 1. My browser gets hijacked to other sites like Target, Amazon, and other less known names. 2. I get a rapid fire multiple openings of my ms explorer browser, all in one group of about 40-50. Here is my log from hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 9:29:51 PM, on 10/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\TCtrlIOHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\System32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\TPSMain.exe
C:\toshiba\ivp\ism\pinger.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\StorageSync\StrgSync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft SQL Server\MSSQL$AUCTIONI\Binn\sqlservr.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Belkin\F1U201.401\usbshare.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshibadirect.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\PIF\comras.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TCtryIOHook] c:\WINDOWS\System32\TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [ZoomingHook] c:\WINDOWS\System32\ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAgentExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [StrgSync.exe] C:\Program Files\StorageSync\StrgSync.exe -w
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: D-Link REG Utility.lnk = ?
O4 - Global Startup: F1U201.401.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Convert for CLIÉ - C:\Program Files\Sony\Image Converter\menu.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://www.anonymize...nner/WebAAS.cab
O20 - Winlogon Notify: comras - C:\WINDOWS\PIF\comras.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Any help would be greatly appreciated. Thank you.

[Advertisements]

Hi Elliott1234 and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

1. Go to Geeks to Go
. Click on My Controls at the top right hand corner of the window. (make sure you have signed in first)
. In the left hand column, click "View Topics"
. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"


3. Please print these instructions out for use in Safe Mode.

Also note, one must be either logged in under the Administrator account or have administrator privileges to be able to successfully complete these procedures

1. Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please REBOOT your computer into Safe Mode.
  
  You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
  
  
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning and a list of forums to seek help at.
  it should look like this
  

  VundoFix V2.1 by Atri
  By pressing enter you agree that you are using this at your own risk
  Please seek assistance at one of the following forums:
  http://www.atribune.org/forums
  http://www.247fixes.com/forums
  http://www.geekstogo.com/forum
  http://forums.net-integration.net
  

• At this point press enter one time.
  
• Next you will see:
  

  Type in the filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  
  • C:\WINDOWS\PIF\comras.dll
  
  
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  
• Next you will see:
  

  Please type in the second filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  C:\WINDOWS\PIF\sarmoc.*
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.

2. The fix will run then HijackThis will open.

• In HiJackThis, please place a check next to the following items and click FIX CHECKED:
  
  
  • O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\PIF\comras.dll
    O20 - Winlogon Notify: comras - C:\WINDOWS\PIF\comras.dll
  
  
• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
• Once your machine reboots please continue with the instructions below.

3. Download and install CleanUp!

• Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• Set the program up as follows:
• Click "Options..."
• Move the arrow down to "Custom CleanUp!"
• Put a check next to the following (Make sure nothing else is checked!):
• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users

[*]Click OK
[*]Press the CleanUp! button to start the program.
[*]It may ask you to reboot at the end, click NO.
[/list]4. Please run this online virus scan: ActiveScan
Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder into this topic.
Regards,

Trevuren

[Trevuren]

Hi Elliott1234 and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

1. Go to Geeks to Go
. Click on My Controls at the top right hand corner of the window. (make sure you have signed in first)
. In the left hand column, click "View Topics"
. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"


3. Please print these instructions out for use in Safe Mode.

Also note, one must be either logged in under the Administrator account or have administrator privileges to be able to successfully complete these procedures

1. Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please REBOOT your computer into Safe Mode.
  
  You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
  
  
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning and a list of forums to seek help at.
  it should look like this
  

  VundoFix V2.1 by Atri
  By pressing enter you agree that you are using this at your own risk
  Please seek assistance at one of the following forums:
  http://www.atribune.org/forums
  http://www.247fixes.com/forums
  http://www.geekstogo.com/forum
  http://forums.net-integration.net
  

• At this point press enter one time.
  
• Next you will see:
  

  Type in the filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  
  • C:\WINDOWS\PIF\comras.dll
  
  
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  
• Next you will see:
  

  Please type in the second filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  C:\WINDOWS\PIF\sarmoc.*
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.

2. The fix will run then HijackThis will open.

• In HiJackThis, please place a check next to the following items and click FIX CHECKED:
  
  
  • O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\PIF\comras.dll
    O20 - Winlogon Notify: comras - C:\WINDOWS\PIF\comras.dll
  
  
• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
• Once your machine reboots please continue with the instructions below.

3. Download and install CleanUp!

• Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• Set the program up as follows:
• Click "Options..."
• Move the arrow down to "Custom CleanUp!"
• Put a check next to the following (Make sure nothing else is checked!):
• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users

[*]Click OK
[*]Press the CleanUp! button to start the program.
[*]It may ask you to reboot at the end, click NO.
[/list]4. Please run this online virus scan: ActiveScan
Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder into this topic.
Regards,

Trevuren

[Elliott1234]

Thank you. When I downloaded VundoFix (selected both RUN and SAVE, separately) I noticed it on my desktop as a folder and icon but when I went into SAFE MODE I could not find it on desktop or in My Computer as a program or file anywhere. I then did a SEARCH for KillVundo.bat and double clicked that file which opened the window, then entered the two file names as you described. It then opened Hijackthis but could not find the 02 file you described. I did a re BOOT, then back into SAFE MODE and opened Hijackthis and scanned files but again did not see the 02 file you described. So, I continued on with the rest of your instructions. One more thing, I have an identical computer with identical problem: should I, at the end of this, post that to this thread as well? Many many thanks. Here is the data you requested so far:


Incident Status Location

Adware:adware/exactsearch No disinfected Windows Registry
Adware:Adware/Alexa-Toolbar No disinfected C:\Program Files\SpyFerret\Archives\alexa toolbar.cab[uninstall.exe]
Adware:Adware/Alexa-Toolbar No disinfected C:\Program Files\SpyFerret\Archives\AlxRes.cab[AlxRes.dll]
Adware:Adware/Alexa-Toolbar No disinfected C:\Program Files\SpyFerret\Archives\AlxTB1.cab[AlxTB1.dll]
Adware:Adware/Alexa-Toolbar No disinfected C:\Program Files\SpyFerret\Archives\AlxTB10.cab[AlxTB1.dll]
Adware:Adware/Alexa-Toolbar No disinfected C:\Program Files\SpyFerret\Archives\AlxTB11.cab[AlxTB1.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras0.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras1.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras10.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras11.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras12.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras13.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras14.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras15.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras16.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras17.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras18.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras19.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras2.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras20.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras21.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras22.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras23.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras24.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras3.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras4.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras5.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras6.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras7.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras8.cab[comras.dll]
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\SpyFerret\Archives\comras9.cab[comras.dll]
Adware:Adware/Alexa-Toolbar No disinfected C:\Program Files\SpyFerret\Archives\uninstall.cab[uninstall.exe]
Virus:Trj/Agent.AJK Disinfected C:\WINDOWS\system32\jkklk.dll

HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 8:39:14 AM, on 10/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\TCtrlIOHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\System32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\toshiba\ivp\ism\pinger.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Apoint2K\Apntex.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\StorageSync\StrgSync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Microsoft SQL Server\MSSQL$AUCTIONI\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Belkin\F1U201.401\usbshare.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\system32\TPSBattM.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshibadirect.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TCtryIOHook] c:\WINDOWS\System32\TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [ZoomingHook] c:\WINDOWS\System32\ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAgentExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [StrgSync.exe] C:\Program Files\StorageSync\StrgSync.exe -w
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: D-Link REG Utility.lnk = ?
O4 - Global Startup: F1U201.401.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Convert for CLIÉ - C:\Program Files\Sony\Image Converter\menu.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://www.anonymize...nner/WebAAS.cab
O20 - Winlogon Notify: comras - C:\WINDOWS\PIF\comras.dll (file missing)
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Elliott1234]

Also,

Here is the VundoFix text file:


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Suspending PID 140 'smss.exe'
Threads [144][148][152]

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 856 'explorer.exe'
Killing PID 856 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Error, Cannot find a process with an image name of rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 212 'winlogon.exe'
Killing PID 212 'winlogon.exe'
Killing PID 212 'winlogon.exe'
Killing PID 212 'winlogon.exe'
Killing PID 212 'winlogon.exe'
Killing PID 212 'winlogon.exe'
File Deleted sucessfully.
Files Deleted sucessfully.

[Trevuren]

Your second computer should be the object of a new thread. Be sure to indicate in the title that it is a second computer.

Please follow the instructions provided, you may want to print out these instructions and use them as a reference.

• Please download ewido security suite it is a trial version of the program.
  
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will prompt you to update click the OK button
  • The program will now go to the main screen
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Click on Start
  • The update will start and a progress bar will show the updates being installed.
• Once the updates are installed do the following:
  • REBOOT into Safe Mode
  • Run EWIDO
  • Click on scanner
  • Click on Start Scan
  • Let the program scan the machine
  • While the scan is in progress you will be prompted to clean files, click OK
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report
  • Save the report to your desktop
• Reboot your machine and post back a new HJT log and the ewido .txt log file you saved by using Add Reply

Regards,

Trevuren

[Elliott1234]

here they are:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10/2/2005 16:23
+ Report-Checksum: 498873A0

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@centrport[2].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Hitslink : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@euniverseads[1].txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@findwhat[1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@mediaplex[2].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@paycounter[1].txt -> Spyware.Cookie.Paycounter : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@qksrv[1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@specificclick[1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@spylog[2].txt -> Spyware.Cookie.Spylog : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Onestat : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@statcounter[2].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][2].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott schmerler@xxxcounter[1].txt -> Spyware.Cookie.Xxxcounter : Cleaned with backup
C:\Documents and Settings\Elliott Schmerler\Desktop\Copied Data\Documents and Settings\Elliott Schmerler\Cookies\elliott [email protected][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Program Files\SpyFerret\Archives\alexa toolbar.cab/uninstall.exe -> Spyware.AlexaBar : Cleaned with backup
C:\Program Files\SpyFerret\Archives\AlxRes.cab/AlxRes.dll -> Spyware.Alexa : Cleaned with backup
C:\Program Files\SpyFerret\Archives\AlxTB1.cab/AlxTB1.dll -> Spyware.AlexaBar : Cleaned with backup
C:\Program Files\SpyFerret\Archives\AlxTB10.cab/AlxTB1.dll -> Spyware.AlexaBar : Cleaned with backup
C:\Program Files\SpyFerret\Archives\AlxTB11.cab/AlxTB1.dll -> Spyware.AlexaBar : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras0.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras1.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras10.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras11.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras12.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras13.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras14.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras15.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras16.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras17.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras18.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras19.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras2.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras20.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras21.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras22.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras23.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras24.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras3.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras4.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras5.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras6.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras7.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras8.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\comras9.cab/comras.dll -> Spyware.Virtumonde : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising1.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising10.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising11.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising110.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising111.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising112.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising113.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising114.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising115.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising116.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising117.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising118.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising119.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising12.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising120.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising121.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising13.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising14.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising15.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising16.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising17.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising18.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising19.cab/elliott schmerler@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising2.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising20.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising21.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising210.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising211.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising22.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising23.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising24.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising25.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising26.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising27.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising28.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleradvertising29.cab/elliott schmerler@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt1.cab/elliott schmerler@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt2.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt20.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt21.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt210.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt211.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt212.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt213.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt214.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt215.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt216.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt217.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt218.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt219.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt22.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt220.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt221.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt222.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt223.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret\Archives\elliott schmerleratdmt224.cab/elliott schmerler@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\P

[Trevuren]

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

• First we need to make all files and folders VISIBLE:
  
  • Go to start>control panel>folder options>view (tab)
  • Choose to "show hidden files and folders,"
  • Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
  • Close the window with ok
• Please RUN HijackThis.
  . Click the SCAN button to produce a log.
  
  
• Place a check mark beside each one of the following items:
  
  O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
  O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
  O20 - Winlogon Notify: comras - C:\WINDOWS\PIF\comras.dll (file missing)
  
• Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
  
  
• Reboot Your System in Safe Mode
  
  How to use the F8 method to Start Your Computer in Safe Mode
  
  
  • Restart the computer.
  • As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
  • Use the arrow keys to select the Safe mode menu item
  • Press Enter.
• Using Windows Explorer, locate the following files/folders, and DELETE them (if they are present):
  
  C:\WINDOWS\web\related.htm
  
  
• Exit Explorer, and REBOOT BACK INTO NORMAL MODE
  
  
• Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everything looks now.

Regards,

Trevuren

[Elliott1234]

Ok, here it is:

Logfile of HijackThis v1.99.1
Scan saved at 6:10:55 PM, on 10/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\TCtrlIOHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\System32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\toshiba\ivp\ism\pinger.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Apoint2K\Apntex.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\Program Files\Microsoft SQL Server\MSSQL$AUCTIONI\Binn\sqlservr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\StorageSync\StrgSync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\Program Files\Belkin\F1U201.401\usbshare.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshibadirect.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TCtryIOHook] c:\WINDOWS\System32\TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [ZoomingHook] c:\WINDOWS\System32\ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAgentExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [StrgSync.exe] C:\Program Files\StorageSync\StrgSync.exe -w
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: D-Link REG Utility.lnk = ?
O4 - Global Startup: F1U201.401.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Convert for CLIÉ - C:\Program Files\Sony\Image Converter\menu.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://www.anonymize...nner/WebAAS.cab
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Elliott1234]

by the way, I could not find the following:

09 - Extra Button: Related - {c95fe080...
09 - Extra "Tools" menuitem: Show...

I did however find and delete 020 - Winlogon Notify: comras - C:\WINDOWS...

Also, did not find: C:\WINDOWS\web\related.htm

Thanks!

[Trevuren]

Your log looks good. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures.

Trevuren

[Elliott1234]

At this point, none that I know of.

[Trevuren]

Congratulations, your log shows that your SYSTEM IS CLEAN

There are a few things you must do once you are completely clean:

1. Re-hide your System Files and Folders to prevent any future accidents.

Reconfigure Windows XP to hide hidden files:

• Click Start. Open My Computer.
• Select the Tools menu and click Folder Options. Select the View Tab.
  
• Under the Hidden files and folders heading deselect "Show hidden files and folders".
• Check the "Hide protected operating system files (recommended)" option.
• Click Yes to confirm. Click OK.

2. Reset and Re-enable your System Restore to remove bad files from the backup that Windows makes as no program is able to clean those files:

TO DISABLE SYSTEM RESTORE

• Right-click "My Computer", and then left click "Properties".
• Left click on "System Restore Tab"
• Check box beside "Turn Off System Restore"
• Left click on "Apply"

TO ENABLE SYSTEM RESTORE

• Remove check mark from "Turn Off System Restore"
• Click on "Apply"

Here are some tips to reduce the potential for spyware infection in the future:

Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

To protect yourself further:

• Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.

And also see TonyKlein's good advice
So how did I get infected in the first place? (My Favorite)

Regards,

Trevuren

[Elliott1234]

Again, many thanks. You provide a great service. I have made a contribution to your cause.

Regards...

[Trevuren]

My Pleasure and Thank You

Trevuren

[Trevuren]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.