Browser runnng slow; Crashing

Please help, my IE 8 keeps crashing and going very slow.

Thank you.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:00:02 PM, on 1/1/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\winl_ogon.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 67.215.245.21 www.google-analytics.com
O1 - Hosts: 95.211.99.109 google.ae
O1 - Hosts: 95.211.99.109 google.as
O1 - Hosts: 95.211.99.109 google.at
O1 - Hosts: 95.211.99.109 google.az
O1 - Hosts: 95.211.99.109 google.ba
O1 - Hosts: 95.211.99.109 google.be
O1 - Hosts: 95.211.99.109 google.bg
O1 - Hosts: 95.211.99.109 google.bs
O1 - Hosts: 95.211.99.109 google.ca
O1 - Hosts: 95.211.99.109 google.cd
O1 - Hosts: 95.211.99.109 google.com.gh
O1 - Hosts: 95.211.99.109 google.com.hk
O1 - Hosts: 95.211.99.109 google.com.jm
O1 - Hosts: 95.211.99.109 google.com.mx
O1 - Hosts: 95.211.99.109 google.com.my
O1 - Hosts: 95.211.99.109 google.com.na
O1 - Hosts: 95.211.99.109 google.com.nf
O1 - Hosts: 95.211.99.109 google.com.ng
O1 - Hosts: 95.211.99.109 google.ch
O1 - Hosts: 95.211.99.109 google.com.np
O1 - Hosts: 95.211.99.109 google.com.pr
O1 - Hosts: 95.211.99.109 google.com.qa
O1 - Hosts: 95.211.99.109 google.com.sg
O1 - Hosts: 95.211.99.109 google.com.tj
O1 - Hosts: 95.211.99.109 google.com.tw
O1 - Hosts: 95.211.99.109 google.dj
O1 - Hosts: 95.211.99.109 google.de
O1 - Hosts: 95.211.99.109 google.dk
O1 - Hosts: 95.211.99.109 google.dm
O1 - Hosts: 95.211.99.109 google.ee
O1 - Hosts: 95.211.99.109 google.fi
O1 - Hosts: 95.211.99.109 google.fm
O1 - Hosts: 95.211.99.109 google.fr
O1 - Hosts: 95.211.99.109 google.ge
O1 - Hosts: 95.211.99.109 google.gg
O1 - Hosts: 95.211.99.109 google.gm
O1 - Hosts: 95.211.99.109 google.gr
O1 - Hosts: 95.211.99.109 google.ht
O1 - Hosts: 95.211.99.109 google.ie
O1 - Hosts: 95.211.99.109 google.im
O1 - Hosts: 95.211.99.109 google.in
O1 - Hosts: 95.211.99.109 google.it
O1 - Hosts: 95.211.99.109 google.ki
O1 - Hosts: 95.211.99.109 google.la
O1 - Hosts: 95.211.99.109 google.li
O1 - Hosts: 95.211.99.109 google.lv
O1 - Hosts: 95.211.99.109 google.ma
O1 - Hosts: 95.211.99.109 google.ms
O1 - Hosts: 95.211.99.109 google.mu
O1 - Hosts: 95.211.99.109 google.mw
O1 - Hosts: 95.211.99.109 google.nl
O1 - Hosts: 95.211.99.109 google.no
O1 - Hosts: 95.211.99.109 google.nr
O1 - Hosts: 95.211.99.109 google.nu
O1 - Hosts: 95.211.99.109 google.pl
O1 - Hosts: 95.211.99.109 google.pn
O1 - Hosts: 95.211.99.109 google.pt
O1 - Hosts: 95.211.99.109 google.ro
O1 - Hosts: 95.211.99.109 google.ru
O1 - Hosts: 95.211.99.109 google.rw
O1 - Hosts: 95.211.99.109 google.sc
O1 - Hosts: 95.211.99.109 google.se
O1 - Hosts: 95.211.99.109 google.sh
O1 - Hosts: 95.211.99.109 google.si
O1 - Hosts: 95.211.99.109 google.sm
O1 - Hosts: 95.211.99.109 google.sn
O1 - Hosts: 95.211.99.109 google.st
O1 - Hosts: 95.211.99.109 google.tl
O1 - Hosts: 95.211.99.109 google.tm
O1 - Hosts: 95.211.99.109 google.tt
O1 - Hosts: 95.211.99.109 google.us
O1 - Hosts: 95.211.99.109 google.vu
O1 - Hosts: 95.211.99.109 google.ws
O1 - Hosts: 95.211.99.109 google.co.ck
O1 - Hosts: 95.211.99.109 google.co.id
O1 - Hosts: 95.211.99.109 google.co.il
O1 - Hosts: 95.211.99.109 google.co.in
O1 - Hosts: 95.211.99.109 google.co.jp
O1 - Hosts: 95.211.99.109 google.co.kr
O1 - Hosts: 95.211.99.109 google.co.ls
O1 - Hosts: 95.211.99.109 google.co.ma
O1 - Hosts: 95.211.99.109 google.co.nz
O1 - Hosts: 95.211.99.109 google.co.tz
O1 - Hosts: 95.211.99.109 google.co.ug
O1 - Hosts: 95.211.99.109 google.co.uk
O1 - Hosts: 95.211.99.109 google.co.za
O1 - Hosts: 95.211.99.109 google.co.zm
O1 - Hosts: 95.211.99.109 google.com
O1 - Hosts: 95.211.99.109 google.com.af
O1 - Hosts: 95.211.99.109 google.com.ag
O1 - Hosts: 95.211.99.109 google.com.ar
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 11594 bytes

Please re-open HijackThis and scan. Check the boxes to the left of all the entries listed below.

O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 67.215.245.21 www.google-analytics.com
O1 - Hosts: 95.211.99.109 google.ae
O1 - Hosts: 95.211.99.109 google.as
O1 - Hosts: 95.211.99.109 google.at
O1 - Hosts: 95.211.99.109 google.az
O1 - Hosts: 95.211.99.109 google.ba
O1 - Hosts: 95.211.99.109 google.be
O1 - Hosts: 95.211.99.109 google.bg
O1 - Hosts: 95.211.99.109 google.bs
O1 - Hosts: 95.211.99.109 google.ca
O1 - Hosts: 95.211.99.109 google.cd
O1 - Hosts: 95.211.99.109 google.com.gh
O1 - Hosts: 95.211.99.109 google.com.hk
O1 - Hosts: 95.211.99.109 google.com.jm
O1 - Hosts: 95.211.99.109 google.com.mx
O1 - Hosts: 95.211.99.109 google.com.my
O1 - Hosts: 95.211.99.109 google.com.na
O1 - Hosts: 95.211.99.109 google.com.nf
O1 - Hosts: 95.211.99.109 google.com.ng
O1 - Hosts: 95.211.99.109 google.ch
O1 - Hosts: 95.211.99.109 google.com.np
O1 - Hosts: 95.211.99.109 google.com.pr
O1 - Hosts: 95.211.99.109 google.com.qa
O1 - Hosts: 95.211.99.109 google.com.sg
O1 - Hosts: 95.211.99.109 google.com.tj
O1 - Hosts: 95.211.99.109 google.com.tw
O1 - Hosts: 95.211.99.109 google.dj
O1 - Hosts: 95.211.99.109 google.de
O1 - Hosts: 95.211.99.109 google.dk
O1 - Hosts: 95.211.99.109 google.dm
O1 - Hosts: 95.211.99.109 google.ee
O1 - Hosts: 95.211.99.109 google.fi
O1 - Hosts: 95.211.99.109 google.fm
O1 - Hosts: 95.211.99.109 google.fr
O1 - Hosts: 95.211.99.109 google.ge
O1 - Hosts: 95.211.99.109 google.gg
O1 - Hosts: 95.211.99.109 google.gm
O1 - Hosts: 95.211.99.109 google.gr
O1 - Hosts: 95.211.99.109 google.ht
O1 - Hosts: 95.211.99.109 google.ie
O1 - Hosts: 95.211.99.109 google.im
O1 - Hosts: 95.211.99.109 google.in
O1 - Hosts: 95.211.99.109 google.it
O1 - Hosts: 95.211.99.109 google.ki
O1 - Hosts: 95.211.99.109 google.la
O1 - Hosts: 95.211.99.109 google.li
O1 - Hosts: 95.211.99.109 google.lv
O1 - Hosts: 95.211.99.109 google.ma
O1 - Hosts: 95.211.99.109 google.ms
O1 - Hosts: 95.211.99.109 google.mu
O1 - Hosts: 95.211.99.109 google.mw
O1 - Hosts: 95.211.99.109 google.nl
O1 - Hosts: 95.211.99.109 google.no
O1 - Hosts: 95.211.99.109 google.nr
O1 - Hosts: 95.211.99.109 google.nu
O1 - Hosts: 95.211.99.109 google.pl
O1 - Hosts: 95.211.99.109 google.pn
O1 - Hosts: 95.211.99.109 google.pt
O1 - Hosts: 95.211.99.109 google.ro
O1 - Hosts: 95.211.99.109 google.ru
O1 - Hosts: 95.211.99.109 google.rw
O1 - Hosts: 95.211.99.109 google.sc
O1 - Hosts: 95.211.99.109 google.se
O1 - Hosts: 95.211.99.109 google.sh
O1 - Hosts: 95.211.99.109 google.si
O1 - Hosts: 95.211.99.109 google.sm
O1 - Hosts: 95.211.99.109 google.sn
O1 - Hosts: 95.211.99.109 google.st
O1 - Hosts: 95.211.99.109 google.tl
O1 - Hosts: 95.211.99.109 google.tm
O1 - Hosts: 95.211.99.109 google.tt
O1 - Hosts: 95.211.99.109 google.us
O1 - Hosts: 95.211.99.109 google.vu
O1 - Hosts: 95.211.99.109 google.ws
O1 - Hosts: 95.211.99.109 google.co.ck
O1 - Hosts: 95.211.99.109 google.co.id
O1 - Hosts: 95.211.99.109 google.co.il
O1 - Hosts: 95.211.99.109 google.co.in
O1 - Hosts: 95.211.99.109 google.co.jp
O1 - Hosts: 95.211.99.109 google.co.kr
O1 - Hosts: 95.211.99.109 google.co.ls
O1 - Hosts: 95.211.99.109 google.co.ma
O1 - Hosts: 95.211.99.109 google.co.nz
O1 - Hosts: 95.211.99.109 google.co.tz
O1 - Hosts: 95.211.99.109 google.co.ug
O1 - Hosts: 95.211.99.109 google.co.uk
O1 - Hosts: 95.211.99.109 google.co.za
O1 - Hosts: 95.211.99.109 google.co.zm
O1 - Hosts: 95.211.99.109 google.com
O1 - Hosts: 95.211.99.109 google.com.af
O1 - Hosts: 95.211.99.109 google.com.ag
O1 - Hosts: 95.211.99.109 google.com.ar

Then, please exit all programs except for HijackThis (System Tray (bottom right of screen): right-click on each program icon and click an Exit or shut down option, etc.), then click Fix Checked.

After it completes its process, please close HijackThis and reboot your computer.

==

Please download Malwarebytes Anti-Malware from here.
(Note: if you already have the program installed, just follow the directions. No need to re-download or re-install!)

Double Click mbam-setup.exe to install the application.

(Note: if you already have the program installed, open Malwarebytes from the Start Menu or Desktop shortcut, click the Update tab, and click Check for Updates, before doing the scan as instructed below!)

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• Please save the log to a location you will remember.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Thank you for the quick relpy.

I did what you said with the Hijack This, but when I went to run Malware, it shut down in the middle of the scan and I was brought to a blue screen that said I had to restat my computer. Is there something I can do now?

Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Alternate link: Forospyware.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
  
• Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.
  
• When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.
  

ComboFix 10-01-02.01 - Owner 01/02/2010 15:14:23.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.213 [GMT -8:00]
Running from: c:\documents and settings\Owner\desktop\commy.exe
Command switches used :: /stepdel
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\ifitymo._sy
c:\windows\run.log
c:\windows\system32\xa.tmp

.
original MBR restored successfully !
.
((((((((((((((((((((((((( Files Created from 2009-12-02 to 2010-01-02 )))))))))))))))))))))))))))))))
.

2010-01-02 04:08 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-02 04:04 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2010-01-02 04:04 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2010-01-02 04:04 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2010-01-02 04:04 . 2009-06-25 08:25 730112 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2010-01-02 04:04 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2010-01-02 04:03 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2010-01-02 04:03 . 2009-08-04 15:13 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-02 04:03 . 2009-08-05 04:44 2189184 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-02 04:03 . 2009-08-04 14:20 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-02 04:03 . 2009-10-29 07:45 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-02 04:03 . 2009-10-29 07:45 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-02 04:03 . 2009-10-29 07:45 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-01-02 04:03 . 2009-10-29 07:45 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-02 04:03 . 2009-10-29 07:45 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-01-02 04:03 . 2009-10-29 07:45 11069952 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-01-02 04:03 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-01-02 04:01 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-02 04:00 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-02 04:00 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-02 03:59 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-02 03:58 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-02 03:57 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-02 03:57 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-01-02 02:18 . 2010-01-02 12:19 -------- d-----w- c:\documents and settings\HelpAssistant
2010-01-01 02:35 . 2010-01-01 08:47 -------- d-----w- c:\documents and settings\Owner\Application Data\Apple Computer
2010-01-01 02:34 . 2009-05-18 22:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-01-01 02:34 . 2008-04-17 21:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-01-01 02:32 . 2010-01-01 02:32 -------- d-----w- c:\program files\iPod
2010-01-01 02:32 . 2010-01-01 02:34 -------- d-----w- c:\program files\iTunes
2010-01-01 02:32 . 2010-01-01 02:34 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-01-01 02:31 . 2010-01-01 02:31 -------- d-----w- c:\program files\Bonjour
2010-01-01 02:29 . 2010-01-01 02:31 -------- d-----w- c:\program files\QuickTime
2010-01-01 02:29 . 2010-01-01 02:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-31 04:14 . 2009-07-31 18:05 1372672 -c----w- c:\windows\system32\dllcache\msxml6.dll
2009-12-31 04:14 . 2008-04-14 06:57 79872 -c----w- c:\windows\system32\dllcache\msxml6r.dll
2009-12-31 03:05 . 2009-12-31 04:14 -------- d-----w- c:\windows\ServicePackFiles
2009-12-31 02:08 . 2008-04-14 13:41 498742 ----a-w- c:\windows\system32\dxmasf.dll
2009-12-31 02:08 . 2009-08-26 08:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-12-31 02:07 . 2009-12-31 02:09 -------- d--h--w- c:\windows\msdownld.tmp
2009-12-31 02:07 . 2009-12-31 02:07 -------- d-----w- c:\windows\Windows Update Setup Files
2009-12-29 22:02 . 2001-08-18 06:36 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2009-12-29 22:01 . 2001-08-18 12:00 14848 -c--a-w- c:\windows\system32\dllcache\flattemp.exe
2009-12-29 21:49 . 2008-04-14 13:42 409088 ----a-w- c:\windows\system32\qmgr.dll
2009-12-29 21:48 . 2008-04-14 13:42 184320 ----a-w- c:\windows\system32\accwiz.exe
2009-12-29 21:47 . 2008-04-14 08:02 196224 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2009-12-29 21:47 . 2008-04-14 08:15 52864 ----a-w- c:\windows\system32\drivers\dmusic.sys
2009-12-29 21:47 . 2008-04-14 08:15 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2009-12-29 21:47 . 2008-04-14 08:10 57600 ----a-w- c:\windows\system32\drivers\redbook.sys
2009-12-29 21:44 . 2008-04-14 13:41 4096 ----a-w- c:\windows\system32\ksuser.dll
2009-12-29 21:44 . 2004-08-04 06:31 20992 ----a-w- c:\windows\system32\drivers\rtl8139.sys
2009-12-29 21:42 . 2008-04-14 13:43 40840 ----a-w- c:\windows\system32\drivers\termdd.sys
2009-12-29 21:34 . 2008-04-14 13:42 146432 ----a-w- c:\windows\system\winspool.drv
2009-12-29 21:34 . 2008-04-14 08:24 11264 ----a-w- c:\windows\system32\drivers\irenum.sys
2009-12-29 21:34 . 2001-08-18 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-12-29 21:34 . 2001-08-18 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-12-29 21:34 . 2001-08-18 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-12-29 21:34 . 2001-08-18 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-12-29 21:34 . 2008-04-14 13:42 74752 ----a-w- c:\windows\system32\storprop.dll
2009-12-23 09:49 . 2009-12-23 09:49 -------- d-sh--w- c:\documents and settings\All Users\Application Data\WSUJSD_APDM
2009-12-23 09:49 . 2009-12-23 09:50 -------- d-sh--w- c:\documents and settings\All Users\Application Data\9466e0d

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-02 23:24 . 2008-07-30 06:14 196 ----a-w- c:\windows\system32\drivers\ALCICH.DAT
2010-01-02 20:12 . 2008-05-02 04:45 -------- d-----w- c:\documents and settings\Owner\Application Data\LimeWire
2010-01-02 07:48 . 2008-07-19 04:16 -------- d-----w- c:\program files\Call of Duty
2010-01-02 04:57 . 2009-12-29 23:08 52224 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-02 04:57 . 2009-03-21 07:46 117760 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-02 03:17 . 2009-08-08 00:39 -------- d-----w- c:\program files\M_alwarebytes' Anti_-Malware
2010-01-02 03:17 . 2009-03-23 01:17 5061520 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-01 02:32 . 2008-12-27 01:49 -------- d-----w- c:\program files\Common Files\Apple
2009-12-30 22:55 . 2009-01-27 20:23 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-30 22:54 . 2009-01-27 20:23 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-29 21:52 . 2009-12-29 21:50 76825 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-12-29 21:49 . 2001-01-17 07:43 23388 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-29 21:48 . 2009-12-29 21:48 295424 ----a-w- c:\windows\system32\termsrv32.dll
2009-11-21 15:51 . 2001-08-18 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-19 00:41 . 2008-05-02 04:21 -------- d-----w- c:\program files\McAfee
2009-11-18 06:19 . 2001-01-17 07:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-18 05:07 . 2009-11-18 05:07 -------- d-----w- c:\program files\Ubisoft
2009-11-13 01:07 . 2009-11-13 01:07 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-05 01:14 . 2009-08-16 22:58 167936 ----a-w- c:\windows\system32\appmgmts.dll
2009-11-05 00:23 . 2008-12-11 19:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-05 00:22 . 2009-08-09 23:52 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-11-04 20:46 . 2001-01-17 08:35 57728 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 08:55 . 2009-11-01 08:55 201728 ----a-w- c:\windows\system32\hope_joy_peace.scr
2009-11-01 08:54 . 2009-11-01 08:54 201728 ----a-w- c:\windows\system32\snow2.scr
2009-11-01 08:53 . 2008-11-28 02:59 197120 ----a-w- c:\windows\system32\happy_holidays.scr
2009-10-29 07:45 . 2002-08-29 15:14 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2001-01-17 08:13 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38 . 2001-01-17 08:13 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2001-01-17 08:13 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2001-08-18 12:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2001-08-18 12:00 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2001-08-18 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-05 07:14 . 2009-10-05 07:17 389120 ----a-w- c:\windows\system32\CF26424.exe
2009-10-05 06:14 . 2003-03-19 04:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-10-05 06:14 . 2003-02-21 12:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-08-12 22:11 . 2009-08-08 07:45 120244256 --sha-w- c:\windows\system32\drivers\fidbox.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-13 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2006-10-22 7700480]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-13 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
backup=c:\windows\pss\ERUNT AutoBackup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\PowerReg Scheduler.exe
backup=c:\windows\pss\PowerReg Scheduler.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-12 05:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2009-09-16 16:10 3634024 ----a-w- c:\program files\AIM\aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2008-12-19 01:18 342848 ----a-w- c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 13:42 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
2009-10-13 02:29 122880 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-12-22 16:38 241664 ----a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-08-05 01:28 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfee Backup]
2009-07-09 03:22 5134864 ----a-w- c:\program files\McAfee\MBK\McAfeeDataBackup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
2009-10-29 14:54 1218008 ----a-w- c:\program files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2001-08-22 22:52 331830 ----a-w- c:\program files\Microsoft Works\wkssb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
2001-07-25 18:00 184376 ----a-w- c:\program files\Microsoft Money\System\Money Express.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp10.0]
2001-07-25 18:00 241714 ----a-w- c:\program files\Microsoft Money\System\Activation.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2007-10-18 18:34 5724184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 18:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-10-22 20:22 7700480 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-10-22 20:22 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-10-22 20:22 1622016 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 07:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2001-07-03 17:11 57344 ----a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSUSBRG]
2002-02-21 08:01 28675 ----a-r- c:\windows\SiSUSBrg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2001-05-29 17:02 124416 ------w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-11-05 00:23 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-13 02:29 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-10-05 06:14 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2001-10-05 01:34 24576 ----a-w- c:\program files\Microsoft Works\wkfud.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
2008-12-12 20:41 157312 ----a-w- c:\program files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MSC\\McUICnt.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\McAfee.com\\Agent\\mcagent.exe"=
"c:\\WINDOWS\\system32\\dwwin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"7417:TCP"= 7417:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 3:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 3:06 PM 74480]
S3 fsbl;F-Secure BlackLight Engine Driver;\??\c:\docume~1\Owner\LOCALS~1\Temp\ce845bab-5a0e-4ba4-aa72-096de9c4ce28\fsbldrv.sys --> c:\docume~1\Owner\LOCALS~1\Temp\ce845bab-5a0e-4ba4-aa72-096de9c4ce28\fsbldrv.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 3:06 PM 7408]
.
Contents of the 'Scheduled Tasks' folder

2010-01-02 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 18:20]

2010-01-02 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-08-07 23:55]

2009-12-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-05-02 19:22]

2010-01-02 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-05-02 19:22]
.

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.aol.com/
uInternet Settings,ProxyOverride = ;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\m27m607o.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
MSConfigStartUp-net - c:\docume~1\Owner\LOCALS~1\Temp\prun.tmp
AddRemove-HijackThis - c:\documents and settings\Owner\Desktop\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-02 15:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{539cada2-bdea-4fe9-9fed-deaf4ea0e3be}\InprocServer32]
@DACL=(02 0000)
@="c:\\windows\\system32\\dezayuwu.dll"
"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"Installed"="1"
"NoChange"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(564)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3736)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\ZuneBusEnum.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\McAfee\MPF\MPFSrv.exe
.
**************************************************************************
.
Completion time: 2010-01-02 15:31:45 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-02 23:31

Pre-Run: 78,879,436,800 bytes free
Post-Run: 79,487,520,768 bytes free

- - End Of File - - 0802B90EE7D9C2DFAEF0925772982006

I did as you told me to do, but nothing came up in the run of the scanner. Has the virus been cleared or is there something else you could suggest? Just in case, here's the log.

Malwarebytes' Anti-Malware 1.43
Database version: 3485
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/3/2010 2:33:09 AM
mbam-log-2010-01-03 (02-33-09).txt

Scan type: Full Scan (C:\|)
Objects scanned: 256539
Time elapsed: 1 hour(s), 21 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Please download Cheetah-Anti-Rogue, and save to your Desktop.

• Double-click on Cheetah-Anti-Rogue.zip, and extract the file to your Desktop.
  
• Double-click on Cheetah-Anti-Rogue.cmd to start.
  
• It will finish quickly and launch a log.
  
• Post the contents of it in your next reply.

Thanks for the quick answer!

Cheetah Anti-Rogue v1.0.14
by DragonMaster Jay

Microsoft Windows XP [Version 5.1.2600]
Sun 01/03/2010 2:40:07.28


-- Known infection --

c:\windows\system32\drivers\fidbox.dat (Rtk.ParetoLogic)


If objects found, full virus scan or anti-malware scan necessary


EOF

F/P in that log. Fixt.

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic
  

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=e506dbd81783e5469a25aeef0946a375
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-01-04 09:40:41
# local_time=2010-01-04 01:40:41 (-0800, Pacific Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=768 16777215 100 0 12906199 12906199 0 0
# compatibility_mode=5121 16776533 100 96 2991257 15426901 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=124255
# found=7
# cleaned=7
# scan_time=4267
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR5.tmp Win32/Qhost trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR8.tmp Win32/Qhost trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFRE.tmp Win32/Qhost trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\HelpAssistant\Local Settings\temp\44B.tmp a variant of Win32/Mebroot.DC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\HelpAssistant\Local Settings\temp\44C.tmp a variant of Win32/Mebroot.DC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\HelpAssistant\Local Settings\temp\44F.tmp a variant of Win32/Mebroot.DC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\HelpAssistant\Local Settings\temp\tTwh.exe a variant of Win32/TrojanDownloader.Mebload.U trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Please download Stealth MBR Rootkit Detector by GMER from GMER.net, and save to your Desktop.

• Double-click mbr.exe to start the program.
  
• When done scanning, it will save a log on the Desktop called mbr.log.
  
• Please post the contents of that log in your next reply.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x0FFFAC44
malicious code @ sector 0x0FFFAC47 !
PE file found in sector at 0x0FFFAC5D !

Please open Command Prompt (Start > Run and type CMD and press OK [Vista/7: Start search: CMD and press enter])
Enter the following in to the black box, pressing enter after each line:



Post a log (MBR.log).

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x0FFFAC44
malicious code @ sector 0x0FFFAC47 !
PE file found in sector at 0x0FFFAC5D !

Please download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
  
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
  
• Click OK.
  
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

I didn't get asked for a scan, but my computer did restart once the program was started and after I saved the log. Is that all right?

MER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-01-05 03:18:09
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pwtiykoc.sys


---- System - GMER 1.0.15 ----

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xF56C978A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xF56C9821]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xF56C9738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF56C974C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xF56C9835]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF56C9861]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xF56C98CF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xF56C98B9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF56C97CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xF56C98FB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xF56C980D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xF56C9710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xF56C9724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF56C979E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xF56C9937]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xF56C98A3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xF56C988D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xF56C984B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xF56C9923]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xF56C990F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xF56C9776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF56C9762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xF56C9877]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF56C97F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xF56C98E5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF56C97E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xF56C97B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

---- EOF - GMER 1.0.15 ----

Please download the Kaspersky AVP Tool from Kaspersky-labs.com.

• Save it to your desktop.
  
• Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).
  
• Double click the setup file to run it.
  
• Click Next to continue.
  
• It will by default install it to your desktop folder.Click Next.
  
• Hit ok at the prompt for scanning in Safe Mode.
  
• It will then open a box There will be a tab that says Automatic scan.
  
• Under Automatic scan make sure these are checked:
  
  
  • System Memory
    
  • Startup Objects
    
  • Disk Boot Sectors.
    
  • My Computer.
    
  • Also any other drives (Removable that you may have)

After that click on Security level then choose Customize then click on the tab that says Heuristic Analyzer then choose Enable Deep rootkit search then choose ok.
Then choose OK again then you are back to the main screen.

• Then click on Scan at the to right hand Corner.
  
• It will automatically Neutralize any objects found.
  
• If some objects are left un-neutralized then click the button that says Neutralize all
  
• If it says it cannot be Neutralized then chooose The delete option when prompted.
  
• After that is done click on the reports button at the bottom and save it to file name it Kas.
  
• Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.

Note: This tool will self uninstall when you close it so please save the log before closing it.

Autoscan: completed 2 minutes ago (events: 152, objects: 586311, time: 13:23:52)
1/7/2010 1:03:50 AM Task started
1/7/2010 1:18:08 AM Detected: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\HelpAssistant\Desktop\backups\backup-20100102-032005-692
1/7/2010 1:18:08 AM Untreated: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\HelpAssistant\Desktop\backups\backup-20100102-032005-692 Postponed
1/7/2010 1:19:57 AM Detected: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\51I205GF\install[2].exe
1/7/2010 1:19:57 AM Untreated: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\51I205GF\install[2].exe Postponed
1/7/2010 1:20:04 AM Detected: Trojan.Win32.FraudPack.aeft C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\AYTZA7C9\install[2].exe
1/7/2010 1:20:04 AM Untreated: Trojan.Win32.FraudPack.aeft C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\AYTZA7C9\install[2].exe Postponed
1/7/2010 1:20:54 AM Detected: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\ZDHWPBFH\install[3].exe
1/7/2010 1:20:54 AM Untreated: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\ZDHWPBFH\install[3].exe Postponed
1/7/2010 1:33:23 AM Detected: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\Owner\Desktop\backups\backup-20100102-032005-692
1/7/2010 1:33:23 AM Untreated: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\Owner\Desktop\backups\backup-20100102-032005-692 Postponed
1/7/2010 1:41:44 AM Detected: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FS11V3UZ\search[4].htm
1/7/2010 1:41:44 AM Untreated: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FS11V3UZ\search[4].htm Postponed
1/7/2010 1:44:17 AM Detected: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OC15LWMT\comicprofile[1].htm
1/7/2010 1:44:17 AM Untreated: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OC15LWMT\comicprofile[1].htm Postponed
1/7/2010 3:12:46 AM Detected: Trojan.Win32.Vilsel.pom C:\Qoobox\Quarantine\C\WINDOWS\system32\xa.tmp.vir/PE_Patch.Molebox/Molebox
1/7/2010 3:12:46 AM Untreated: Trojan.Win32.Vilsel.pom C:\Qoobox\Quarantine\C\WINDOWS\system32\xa.tmp.vir/PE_Patch.Molebox/Molebox Postponed
1/7/2010 3:30:55 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008562.exe
1/7/2010 3:30:55 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008562.exe Postponed
1/7/2010 3:30:55 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008568.exe
1/7/2010 3:30:55 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008568.exe Postponed
1/7/2010 3:30:56 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008598.exe
1/7/2010 3:30:56 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008598.exe Postponed
1/7/2010 3:31:20 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008839.exe
1/7/2010 3:31:20 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008839.exe Postponed
1/7/2010 3:31:20 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008842.exe
1/7/2010 3:31:20 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008842.exe Postponed
1/7/2010 3:31:21 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008864.exe
1/7/2010 3:31:21 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008864.exe Postponed
1/7/2010 4:58:06 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010272.exe
1/7/2010 4:58:06 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010272.exe Postponed
1/7/2010 4:58:06 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010275.exe
1/7/2010 4:58:06 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010275.exe Postponed
1/7/2010 4:58:07 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010301.exe
1/7/2010 4:58:07 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010301.exe Postponed
1/7/2010 4:58:28 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010867.exe
1/7/2010 4:58:28 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010867.exe Postponed
1/7/2010 4:58:29 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010871.exe
1/7/2010 4:58:29 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010871.exe Postponed
1/7/2010 4:58:29 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010898.exe
1/7/2010 4:58:29 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010898.exe Postponed
1/7/2010 4:58:48 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011453.exe
1/7/2010 4:58:48 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011453.exe Postponed
1/7/2010 4:58:48 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011456.exe
1/7/2010 4:58:48 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011456.exe Postponed
1/7/2010 4:58:55 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012454.exe
1/7/2010 4:58:55 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012454.exe Postponed
1/7/2010 4:58:55 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012457.exe
1/7/2010 4:58:55 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012457.exe Postponed
1/7/2010 4:58:55 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012479.exe
1/7/2010 4:58:55 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012479.exe Postponed
1/7/2010 6:12:16 AM Detected: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\HelpAssistant\Desktop\backups\backup-20100102-032005-692
1/7/2010 6:12:16 AM Untreated: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\HelpAssistant\Desktop\backups\backup-20100102-032005-692 Postponed
1/7/2010 6:14:08 AM Detected: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\51I205GF\install[2].exe
1/7/2010 6:14:08 AM Untreated: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\51I205GF\install[2].exe Postponed
1/7/2010 6:14:15 AM Detected: Trojan.Win32.FraudPack.aeft C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\AYTZA7C9\install[2].exe
1/7/2010 6:14:15 AM Untreated: Trojan.Win32.FraudPack.aeft C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\AYTZA7C9\install[2].exe Postponed
1/7/2010 6:15:05 AM Detected: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\ZDHWPBFH\install[3].exe
1/7/2010 6:15:05 AM Untreated: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\ZDHWPBFH\install[3].exe Postponed
1/7/2010 6:23:13 AM Detected: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\Owner\Desktop\backups\backup-20100102-032005-692
1/7/2010 6:23:13 AM Untreated: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\Owner\Desktop\backups\backup-20100102-032005-692 Postponed
1/7/2010 6:32:31 AM Detected: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FS11V3UZ\search[4].htm
1/7/2010 6:32:31 AM Untreated: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FS11V3UZ\search[4].htm Postponed
1/7/2010 6:35:16 AM Detected: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OC15LWMT\comicprofile[1].htm
1/7/2010 6:35:16 AM Untreated: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OC15LWMT\comicprofile[1].htm Postponed
1/7/2010 7:43:23 AM Detected: Trojan.Win32.Vilsel.pom C:\Qoobox\Quarantine\C\WINDOWS\system32\xa.tmp.vir/PE_Patch.Molebox/Molebox
1/7/2010 7:43:23 AM Untreated: Trojan.Win32.Vilsel.pom C:\Qoobox\Quarantine\C\WINDOWS\system32\xa.tmp.vir/PE_Patch.Molebox/Molebox Postponed
1/7/2010 7:54:13 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008562.exe
1/7/2010 7:54:13 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008562.exe Postponed
1/7/2010 7:54:14 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008568.exe
1/7/2010 7:54:14 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008568.exe Postponed
1/7/2010 7:54:15 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008598.exe
1/7/2010 7:54:15 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008598.exe Postponed
1/7/2010 7:54:29 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008839.exe
1/7/2010 7:54:29 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008839.exe Postponed
1/7/2010 7:54:29 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008842.exe
1/7/2010 7:54:29 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008842.exe Postponed
1/7/2010 7:54:30 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008864.exe
1/7/2010 7:54:30 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008864.exe Postponed
1/7/2010 7:55:56 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010272.exe
1/7/2010 7:55:56 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010272.exe Postponed
1/7/2010 7:55:56 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010275.exe
1/7/2010 7:55:56 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010275.exe Postponed
1/7/2010 7:55:57 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010301.exe
1/7/2010 7:55:57 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010301.exe Postponed
1/7/2010 7:56:07 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010867.exe
1/7/2010 7:56:07 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010867.exe Postponed
1/7/2010 7:56:07 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010871.exe
1/7/2010 7:56:07 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010871.exe Postponed
1/7/2010 7:56:08 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010898.exe
1/7/2010 7:56:08 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010898.exe Postponed
1/7/2010 7:56:18 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011453.exe
1/7/2010 7:56:18 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011453.exe Postponed
1/7/2010 7:56:18 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011456.exe
1/7/2010 7:56:18 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011456.exe Postponed
1/7/2010 7:56:22 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012454.exe
1/7/2010 7:56:22 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012454.exe Postponed
1/7/2010 7:56:22 AM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012457.exe
1/7/2010 7:56:22 AM Untreated: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012457.exe Postponed
1/7/2010 7:56:22 AM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012479.exe
1/7/2010 7:56:22 AM Untreated: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012479.exe Postponed
1/7/2010 9:12:28 AM Detected: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\HelpAssistant\Desktop\backups\backup-20100102-032005-692

1/7/2010 2:27:02 PM Detected: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\51I205GF\install[2].exe

1/7/2010 2:27:10 PM Detected: Trojan.Win32.FraudPack.aeft C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\AYTZA7C9\install[2].exe

1/7/2010 2:27:12 PM Detected: Packed.Win32.Krap.ai C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\ZDHWPBFH\install[3].exe

1/7/2010 2:27:13 PM Detected: Trojan.Win32.FraudPack.rdo C:\Documents and Settings\Owner\Desktop\backups\backup-20100102-032005-692

1/7/2010 2:27:16 PM Detected: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FS11V3UZ\search[4].htm

1/7/2010 2:27:19 PM Detected: HEUR:Trojan.Script.Iframer C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OC15LWMT\comicprofile[1].htm

1/7/2010 2:27:23 PM Detected: Trojan.Win32.Vilsel.pom C:\Qoobox\Quarantine\C\WINDOWS\system32\xa.tmp.vir/PE_Patch.Molebox/Molebox

1/7/2010 2:27:26 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008562.exe

1/7/2010 2:27:29 PM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008568.exe

1/7/2010 2:27:31 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008598.exe

1/7/2010 2:27:32 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008839.exe

1/7/2010 2:27:35 PM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008842.exe

1/7/2010 2:27:36 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP8\A0008864.exe

1/7/2010 2:27:36 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010272.exe

1/7/2010 2:27:37 PM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010275.exe

1/7/2010 2:27:37 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010301.exe

1/7/2010 2:27:38 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010867.exe

1/7/2010 2:27:38 PM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010871.exe

1/7/2010 2:27:39 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0010898.exe

1/7/2010 2:27:40 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011453.exe

1/7/2010 2:27:40 PM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0011456.exe

1/7/2010 2:27:41 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012454.exe

1/7/2010 2:27:41 PM Detected: Trojan.Win32.FraudPack.aeft C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012457.exe

1/7/2010 2:27:42 PM Detected: Packed.Win32.Krap.ai C:\System Volume Information\_restore{97065245-9E7F-4B0E-90CB-FD64272D7E1C}\RP9\A0012479.exe

1/7/2010 2:27:42 PM Task completed

Please download the OTM.exe by OldTimer.

• Save it to your Desktop.
  
• Please double-click OTM.exe to run it.
  
• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\AYTZA7C9
  C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\ZDHWPBFH
  C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FS11V3UZ
  C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OC15LWMT
  
  
  
• Return to OTM.exe, right click in the "Paste Instructions for Items to be Moved" window (under the light yellow bar) and choose Paste.
  
  
• Click the red Moveit! button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTM.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

==

Please download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start
  button to begin the process. Depending on how often you clean temp
  files, execution time should be anywhere from a few seconds to a minute
  or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

==

To uninstall ComboFix

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall

(Note: Make sure there's a space between the word ComboFix and the forward-slash.)

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.

==

Please post the OTM log in your next reply.

I did what you said to do in the first half but after I clicked Moveit! I got this log with no question of rebooting. Do I do the rest of what you say or is something else wrong?

Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!

OTM by OldTimer - Version 3.1.4.0 log created on 01082010_022413

We'll try a different method.

Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, click No at the prompt.

Click Exit on the Main menu to close the program.

==

Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:

• Select Start > All Programs > Accessories > System tools > System Restore.
  
• On the dialogue box that appears select Create a Restore Point
  
• Click NEXT
  
• Enter a name e.g. Clean
  
• Click CREATE

You now have a clean restore point, to get rid of the bad ones:

• Select Start > All Programs > Accessories > System tools > Disk Cleanup.
  
• In the Drop down box that appears select your main drive e.g. C
  
• Click OK
  
• The System will do some calculation and the display a dialogue box with TABS
  
• Select the More Options Tab.
  
• At the bottom will be a system restore box with a CLEANUP button click this
  
• Accept the Warning and select OK again, the program will close and you are done
  

==

Download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.