1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Help removing win32.agent.gvu

Discussion in 'Malware and Virus Removal Archive' started by phxdonald, 2008/05/01.

  1. 2008/05/01
    phxdonald

    phxdonald Inactive Thread Starter

    Joined:
    2008/05/01
    Messages:
    6
    Likes Received:
    0
    You'd think after being in the IT field for the last 10 years I'd know better, but I made a major id10t error. I went to a website to view a video post that a friend sent me. I was told that I needed an updated Codec and it had me download a file mssetup.exe. Once I ran it I started having problems in IE and navigating folders on my hard drive. I am getting a message that states "Your system is infected with a dangerous virus! Note: Strongly recommend to install antispyware program to clean your system and avoid a total crash of your computer! Click OK to download the antispyware (Recommended)" I was dumb once, but not twice, I did not click OK. I ran a full virus scan using AVG 8 Free, but it came up clean. I then ran spybot, and it found win32.agent.gvu. I clicked to remove it, but it keeps coming back. I get the message as soon as I open IE or folders from my hard drive. I do not get the message if I use FireFox.That all being said, I have installed HijackThis and Deckard's system scanner. Here is the results of main.txt.

    Deckard's System Scanner v20071014.68
    Run by Donald Small on 2008-05-01 06:54:02
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------



    -- HijackThis (run as Donald Small.exe) ----------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:54:35 AM, on 5/1/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Python25\lib\site-packages\win32\PythonService.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe
    C:\Program Files\TiVo\Desktop\TiVoNotify.exe
    C:\Program Files\TiVo\Desktop\TiVoServer.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Documents and Settings\Donald Small\My Documents\Downloads\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\DONALD~1.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.azcentral.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Discover deskshop Browser Helper Object - {8DB3D69D-DA5E-4165-B781-72A761790672} - C:\WINDOWS\system32\BhoDshop.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: SSVHelper - {96488BA0-1A53-4583-8AC8-DB77560E8876} - C:\WINDOWS\onenasek.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] //~c:\program files\java\jre1.6.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" /service /registry /auto:TivoTransfer
    O4 - HKCU\..\Run: [TivoNotify] "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" /service /registry /auto:TivoNotify
    O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /registry /auto:TivoServer
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [BitTorrent DNA] //~c:\program files\dna\btdna.exe
    O4 - HKCU\..\Run: [MoneyBackgoundBanking] //~c:\program files\microsoft money plus\mnycorefiles\mnybbsvc.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Secure Online Account Numbers - {F74E75A5-96BF-40ef-A1C8-88EAEBB82AB6} - C:\Program Files\Secure Online Account Numbers\SOAN.exe
    O15 - Trusted Zone: *.myspace.com
    O15 - Trusted Zone: *.ruralmetro.com
    O15 - Trusted Zone: *.target.com
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
    O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://portal.ruralmetro.com/,DanaInfo=NotesHQ.rmetro.com,SSL,CT=java+iNotes6W.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
    O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137552693953
    O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://217.197.149.13/activex/AMC.cab
    O16 - DPF: {81449547-EB5D-422E-8730-932DC5E412C8} (UVUPlayer Control) - http://downloads.dreamtank.com/uvuplayer_01i.cab
    O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
    O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://198.182.65.154/activex/AxisCamControl.cab
    O16 - DPF: {958FCAB0-616B-11D3-A63F-00001B322780} (TimetickerLittleHelpers.usfServer) - http://www.timeticker.com/Timeset/TcpServer.CAB
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://www.carilloncams.com/activex/AMC.cab
    O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://portal.ruralmetro.com/dana-cached/setup/JuniperSetup.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL,avgrsstx.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: fxsst.exe - Unknown owner - C:\WINDOWS\system32\fxsst.exe (file missing)
    O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: netrap.exe - Unknown owner - C:\WINDOWS\system32\netrap.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
    O23 - Service: OSCM Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
    O23 - Service: pyTivo - Unknown owner - C:\Python25\lib\site-packages\win32\PythonService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: TiVo.Net Auto-Transcoding Service - Pipkin Technologies - C:\Program Files\Pipkin Technologies\TiVo.Net\TiVoDotNet.exe
    O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    --
    End of file - 13371 bytes

    -- Files created between 2008-04-01 and 2008-05-01 -----------------------------

    2008-04-30 23:36:33 0 d--h----- C:\$AVG8.VAULT$
    2008-04-30 22:56:33 0 d-------- C:\Program Files\Trend Micro
    2008-04-30 22:28:09 0 dr-h----- C:\Documents and Settings\Donald Small\Recent
    2008-04-30 22:01:13 221184 --a------ C:\WINDOWS\onenasek.dll
    2008-04-30 07:43:25 0 d-------- C:\WINDOWS\Prefetch
    2008-04-24 18:49:50 0 d-------- C:\WINDOWS\system32\drivers\Avg
    2008-04-24 18:49:41 0 d-------- C:\Program Files\AVG
    2008-04-24 18:49:40 0 d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-04-21 21:42:47 0 d-------- C:\Program Files\Defraggler
    2008-04-21 21:33:57 0 d-------- C:\Program Files\FileZilla Client
    2008-04-20 10:58:02 0 d-------- C:\Program Files\CCleaner
    2008-04-13 10:02:47 0 d-------- C:\Program Files\Lavasoft
    2008-04-13 09:48:48 0 d-------- C:\Program Files\iTunes


    -- Find3M Report ---------------------------------------------------------------

    2008-05-01 06:46:13 0 d-------- C:\Program Files\Plaxo
    2008-05-01 03:05:13 0 d-------- C:\Documents and Settings\Donald Small\Application Data\DNA
    2008-04-30 23:36:33 0 d-------- C:\Program Files\AIM6
    2008-04-30 23:22:58 0 --a------ C:\WINDOWS\system32\w32apiw.dll
    2008-04-30 23:21:47 0 d-------- C:\Program Files\Microsoft Money Plus
    2008-04-30 23:21:47 0 d-------- C:\Documents and Settings\Donald Small\Application Data\BitTorrent
    2008-04-30 23:16:44 0 d-------- C:\Program Files\RegScrubXP
    2008-04-30 22:51:11 0 d-------- C:\Program Files\Trillian
    2008-04-30 07:31:47 0 d-------- C:\Program Files\Messenger
    2008-04-30 07:27:25 0 d-------- C:\Program Files\Windows NT
    2008-04-30 07:27:18 0 d-------- C:\Program Files\Movie Maker
    2008-04-21 21:32:55 0 d-------- C:\Program Files\Java
    2008-04-20 10:30:33 0 d-------- C:\Documents and Settings\Donald Small\Application Data\Hamachi
    2008-04-17 21:55:31 0 d-------- C:\Program Files\Google
    2008-04-14 21:25:11 3134 --a------ C:\WINDOWS\mozver.dat
    2008-04-13 10:02:26 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-13 09:55:20 0 d-------- C:\Program Files\Winamp
    2008-04-13 09:48:56 0 d-------- C:\Program Files\iPod
    2008-04-13 09:46:15 0 d-------- C:\Program Files\QuickTime
    2008-04-09 19:46:22 0 d-------- C:\Program Files\AIMTunes
    2008-03-29 10:04:53 0 d-------- C:\Program Files\filehippo.com
    2008-02-12 14:59:56 7680 --a------ C:\WINDOWS\system32\spdwnwxp.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2008-02-12 14:59:20 434176 --a------ C:\WINDOWS\system32\vbscript.dll <Not Verified; Microsoft Corporation; Microsoft (R) VBScript>
    2008-02-12 14:58:54 81920 --a------ C:\WINDOWS\system32\ieencode.dll <Not Verified; Microsoft Corporation; Microsoft Document Converters>
    2008-02-01 11:11:10 586240 --a------ C:\WINDOWS\WLXPGSS.SCR <Not Verified; Microsoft Corporation; Windows Live Photo Gallery>


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{96488BA0-1A53-4583-8AC8-DB77560E8876}]
    04/30/2008 10:01 PM 221184 --a------ C:\WINDOWS\onenasek.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "= "C:\Program Files\Apoint\Apoint.exe" [10/07/2005 02:13 PM]
    "DVDLauncher "= "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [02/23/2005 03:19 PM]
    "PCMService "= "C:\Program Files\Dell\Media Experience\PCMService.exe" [03/14/2005 12:38 PM]
    "Dell QuickSet "= "C:\Program Files\Dell\QuickSet\quickset.exe" [06/29/2006 12:13 PM]
    "dla "= "C:\WINDOWS\system32\dla\tfswctrl.exe" [05/31/2005 05:33 AM]
    "IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [10/18/2006 06:04 PM]
    "IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [10/18/2006 05:58 PM]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM]
    "SunJavaUpdateSched "= "//~c:\program files\java\jre1.6.0_06\bin\jusched.exe" []
    "AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [04/24/2008 06:49 PM]
    "igfxtray "= "C:\WINDOWS\system32\igfxtray.exe" [06/06/2006 05:09 PM]
    "igfxhkcmd "= "C:\WINDOWS\system32\hkcmd.exe" [06/06/2006 05:06 PM]
    "igfxpers "= "C:\WINDOWS\system32\igfxpers.exe" [06/06/2006 05:10 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 04:00 AM]
    "TivoTransfer "= "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" [09/25/2007 10:33 AM]
    "TivoNotify "= "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" [09/25/2007 10:34 AM]
    "TivoServer "= "C:\Program Files\TiVo\Desktop\TiVoServer.exe" [09/25/2007 10:35 AM]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/09/2007 02:44 PM]
    "BitTorrent DNA "= "//~c:\program files\dna\btdna.exe" []
    "MoneyBackgoundBanking "= "//~c:\program files\microsoft money plus\mnycorefiles\mnybbsvc.exe" []

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
    "RunNarrator "=Narrator.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoViewOnDrive "=0 (0x0)
    "NoLogoff "=0 (0x0)
    "NoWindowsUpdate "=0 (0x0)
    "StartMenuLogOff "=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "appinit_dlls "=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL,avgrsstx.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Notification Packages "= scecli

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe
    "swg "=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    eapsvcs eaphost
    dot3svc dot3svc




    -- End of Deckard's System Scanner: finished at 2008-05-01 06:55:04 ------------

    I'm looking forward to your ideas. Thanks in advance!
     
    phxdonald,
    #1
  2. 2008/05/01
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi phxdonald
    Welcome to Windowsbbs. :)

    I would like to try this first.

    Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in your next reply along with a fresh HijackThis log. Let me know what issues still exist.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

    Thanks
    Geri
     
    Geri,
    #2


  3. to hide this advert.

  4. 2008/05/02
    phxdonald

    phxdonald Inactive Thread Starter

    Joined:
    2008/05/01
    Messages:
    6
    Likes Received:
    0
    I ran the Malwarebytes and it seemed to remove quite a bit. There error message seems to be gone. Below are the logs from that and a new HijackThis log. Does it look like I need to do anything further?

    Malwarebytes' Anti-Malware 1.11
    Database version: 707

    Scan type: Quick Scan
    Objects scanned: 34688
    Time elapsed: 27 minute(s), 51 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 23
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 96
    Files Infected: 1160

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\Interface\{96a48b57-d55d-4b03-895d-7ee0281d1929} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{5522e65b-6538-431a-bdaf-0b096a3fdd1c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\ssv.ssvhelper (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{96488ba0-1a53-4583-8ac8-db77560e8876} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{96488ba0-1a53-4583-8ac8-db77560e8876} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96488ba0-1a53-4583-8ac8-db77560e8876} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{68353829-557c-4906-875b-117f016cd73a} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{8f327912-da1d-4a5e-b11f-fb943c9df36c} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qq games (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{6e1d8c13-b506-495a-995c-be98117a7d3f} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{72848811-111e-44e7-875a-144fe991740e} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a54d3049-ac49-4bf0-8baa-c676c2b01945} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{81667202-fb60-492a-a141-6542821a2b17} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{81667202-fb60-492a-a141-6542821a2b17} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{7368314d-4d47-4371-4f53-5f41766e7839} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\aim plugin for qq games (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)
     
    phxdonald,
    #3
  5. 2008/05/02
    phxdonald

    phxdonald Inactive Thread Starter

    Joined:
    2008/05/01
    Messages:
    6
    Likes Received:
    0
    C:\Program Files\Tencent\QQ Games\Res\face\80-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\80-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\81-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\81-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\82-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\82-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\83-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\83-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\84-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\84-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\85-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\85-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\86-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\86-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\87-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\87-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\88-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\88-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\89-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\89-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\9-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\9-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\90-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\90-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\91-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\91-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\92-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\92-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\93-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\93-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\94-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\94-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\95-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\95-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\96-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\96-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\97-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\97-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\98-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\98-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\99-1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\face\99-2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\FrameDlg\heng.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\FrameDlg\Icon.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\FrameDlg\leftbuttom.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\FrameDlg\lefttop.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\FrameDlg\newicon.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\FrameDlg\rightbuttom.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\FrameDlg\righttop.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\FrameDlg\shu.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\GameShow\default.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\GAShow\female.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\GAShow\male.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bade_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bade_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bade_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bag_num.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bag_pric.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bag_ptyp.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bgli_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bgli_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bgli_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bgli_ti.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_bag.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_buy.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_down.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_exit1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_exit2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_exit3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_first.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_gbpri.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_last.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_less.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_more.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_myit.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_next.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_pay.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_pay1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_pre.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_pres.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_qbpri.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_reset.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_save.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_save2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_shop.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_sknxt.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_skpre.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\bn_up.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\byde_bk1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\byde_bk2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\byde_bk3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\byde_ti.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\chart.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\deta_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\deta_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\deta_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\discount.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\fiton_ti.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\flashmk1.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\flashmk2.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\gameshop.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\gsadv.swf (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\hand1.cur (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\hand2.cur (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\hand3.cur (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\hand4.ani (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\hot.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\indx1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\indx2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\indx3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\itimg_bg.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\lihe_bg.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\loading.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\loading2.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mask_lok.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mask_nvd.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mask_opgd.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mask_yzb.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\money_bg.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myde_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myde_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myde_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myitem.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myit_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myit_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myit_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myla_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myla_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myla_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myla_lbg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myla_lbg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myla_lbg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mypg_bg.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myskla1.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myskla2.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myskla3.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\myskla4.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mysk_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mysk_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mysk_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\mysk_ti.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\new.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\numfont1.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\numfont2.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\package.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\shel_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\shel_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\shel_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\ShopAdv.ini (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\ShopAdv.swf (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\show_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\show_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\show_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\show_ti.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\shpg_bg.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\skmark.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\spla_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\spla_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\spla_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\spla_lbg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\spla_lbg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\spla_lbg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\split_1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\split_2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\split_3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\sta_tip.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab4.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab5.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab6.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab7.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tabblank.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tab_cfg.ini (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tga_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tga_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tga_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tumm_1.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tumm_2.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tumm_3.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tumm_4.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tumm_5.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tumm_bg.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tuto_bg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tuto_bg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ItemShop\tuto_bg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\aimLogo.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\bg.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\borderbl.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\borderbm.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\borderbr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\borderl.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\borderr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\bordertl.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\bordertm.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\bordertr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\icon_help.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Line.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\login01.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\login02.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\logo.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\qqlogo.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\read me.txt (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\title.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\titlet.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Button\tbclose.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Cirpro\bk.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Cirpro\left1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Cirpro\left2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Cirpro\mid1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Cirpro\mid2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Cirpro\right1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Cirpro\right2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Update\left.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Update\mid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Login\Update\right.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\about.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\button_help.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\maintab.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\split.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Thumbs.db.keep (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\userguide.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\bg.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\borderbl.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\borderbm.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\borderbr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\borderl.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\borderr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\bordertl.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\bordertm.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\bordertr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\read me.txt (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\Thumbs.db.keep (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\webborderleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\webbordermid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Border\webborderright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\361button.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\BBSBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\BlueBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\CloseBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\CoinBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\DefaultBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\ExitBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\ExpndBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\HallBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\HelpBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\ItemBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\MaxBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\MinBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\QShowBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\QUIT.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\RestrBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\SetBtn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Button\Thumbs.db.keep (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Tray\icon16X16-16.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Tray\QGm_16.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Tray\QGm_164.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Tray\QGm_256.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\Tray\Thumbs.db.keep (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\Thumbs.db.keep (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\web_bbs.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\web_home.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\web_line.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\web_linel.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\web_next.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\web_pre.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\web_stop.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\MainWin\web\web_updt.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\playerinfopanel\search.bmp (Adware.Agent) -> Quarantined and deleted successfully.
     
    phxdonald,
    #4
  6. 2008/05/02
    phxdonald

    phxdonald Inactive Thread Starter

    Joined:
    2008/05/01
    Messages:
    6
    Likes Received:
    0
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame10.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame11.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame12.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame13.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame14.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame15.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame16.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame17.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame18.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame19.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame20.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame21.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame22.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame23.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame4.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame5.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame6.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame7.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame8.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\PluginGameIcons\newgame9.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_down_center.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_down_left.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_down_right.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_nor_center.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_nor_left.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_nor_right.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_over_center.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_over_left.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\button\button_over_right.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\MainWin\m01.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\MainWin\m02.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\MainWin\m03.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\MainWin\m04.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\bottomleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\bottommid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\bottomright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\button_close.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\button_max.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\button_min.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\button_normal.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\mask_bottomleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\mask_bottomright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\mask_topleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\mask_topright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\midleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\midmid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\midright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\topleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\topmid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Qg2003\skindlg\topright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\QQAVShow\avswitch.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\QQAVShow\qgg.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\QQAVShow\qmm.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\female.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\femaleupload.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\male.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\maleupload.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\qqshow.ts (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13107020 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13107021 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13107046 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13107097 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13109725 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13109968 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13110056 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13111918 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13113599 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13117379 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13119203 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13119269 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13119884 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13120753 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13122005 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13125621 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13126165 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13127364 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13130706 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13135777 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13135780 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13136639 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13138691 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13139647 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13139745 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13140935 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13141268 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13142920 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13143307 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13144607 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13146326 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13146827 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13147373 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13148577 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13148968 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13150679 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13151716 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13152113 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13153227 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13153703 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13154036 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13154438 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13154955 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13155389 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13157162 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13157192 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13157530 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13158320 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13158919 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13159653 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13159977 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13160207 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13160907 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13161454 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13161636 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13162242 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13162279 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13162324 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13162446 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13162470 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13162490 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13164419 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\13165218 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\19660501 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\19660502 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\19660503 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\19660510 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\19660590 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\30000125 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\30000149 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\qqshow\avct\30000178 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\anmtbar.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\arrowleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\arrowright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\chattoolbar.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\faces2bmp.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\hand.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\lock.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\Mobile.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\phone.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\play.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\qqhome.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\qqshow.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\read me.txt (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\send.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\sitdown.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\toolbarb.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\toolbart.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\toolbartl.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\toolbartr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\watch.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\blue.gif (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\bottoml.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\bottomm.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\bottomr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\close.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\midleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\midmid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\midright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\topleft.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\topmid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Room\GIPanel\topright.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\1_left.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\1_mid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\1_right.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\2_left.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\2_mid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\2_right.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\arrow_more.tga (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\itembg.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\itembgwhite.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\roomitem\morebutton.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\01.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\01_dis.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\02.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\02_dis.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\03.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\03_dis.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\04.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\04_dis.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\05.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\05_dis.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\06.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\06_dis.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\07.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\07_dis.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\blue.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\btncontr.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\btnexpd.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\btnexpd2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\btn_refresh.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\ButtonBG.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\ButtonFill.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\game_logo_22.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\game_logo_23.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\game_logo_7.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\game_logo_70.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\game_logo_8.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan1_l.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan1_m.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan1_r.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan2_l.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan2_m.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan2_r.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan3_l.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan3_m.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\pan3_r.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panbg1.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panbg2.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panbg3.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panEx_ad_l.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panEx_ad_m.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panEx_ad_r.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panEx_l.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panEx_m.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\panEx_r.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\read me.txt (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\SelfInfo\supplay.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\arrow.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\Busy.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\Family.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\Free.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\gamevip.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\LedOff.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\LedOff.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\LedOn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Social\LedOn.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Sound\Click.wav (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\Sound\hover.wav (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\TipDlg\line.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\TipDlg\tip.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\TipDlg\title.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\TitlIcon\ChgNick.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\TitlIcon\qqgame.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\TitlIcon\qqgamej.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\TitlIcon\search.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ToolTip\Tipicon.ico (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Res\ToolTip\tipOnLn.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Socket\NetMod.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Storage\MiscStor.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Storage\StorgFml.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Storage\StorgSet.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\ui\CommonUI.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\ui\ItemUI.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\ui\LafUI.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\ui\MainUI.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\ui\MiscUI.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\ui\RoomCpUI.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\ui\SelfUI.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\ui\SocialUI.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Update\ResEx.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Update\Update.exe (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Update\update.ini (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Update\Res\left.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Update\Res\mid.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Update\Res\right.bmp (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Tencent\QQ Games\Update\Res\update.ico (Adware.Agent) -> Quarantined and deleted successfully.



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:57:29 PM, on 5/1/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Python25\lib\site-packages\win32\PythonService.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe
    C:\Program Files\TiVo\Desktop\TiVoNotify.exe
    C:\Program Files\TiVo\Desktop\TiVoServer.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Microsoft Money Plus\MNYCoreFiles\mnybbsvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
     
    phxdonald,
    #5
  7. 2008/05/02
    phxdonald

    phxdonald Inactive Thread Starter

    Joined:
    2008/05/01
    Messages:
    6
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:57:29 PM, on 5/1/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Python25\lib\site-packages\win32\PythonService.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe
    C:\Program Files\TiVo\Desktop\TiVoNotify.exe
    C:\Program Files\TiVo\Desktop\TiVoServer.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Microsoft Money Plus\MNYCoreFiles\mnybbsvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.azcentral.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Discover deskshop Browser Helper Object - {8DB3D69D-DA5E-4165-B781-72A761790672} - C:\WINDOWS\system32\BhoDshop.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] //~c:\program files\java\jre1.6.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" /service /registry /auto:TivoTransfer
    O4 - HKCU\..\Run: [TivoNotify] "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" /service /registry /auto:TivoNotify
    O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /registry /auto:TivoServer
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [BitTorrent DNA] //~c:\program files\dna\btdna.exe
    O4 - HKCU\..\Run: [MoneyBackgoundBanking] "C:\Program Files\Microsoft Money Plus\MNYCoreFiles\mnybbsvc.exe "
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Secure Online Account Numbers - {F74E75A5-96BF-40ef-A1C8-88EAEBB82AB6} - C:\Program Files\Secure Online Account Numbers\SOAN.exe
    O15 - Trusted Zone: *.myspace.com
    O15 - Trusted Zone: *.ruralmetro.com
    O15 - Trusted Zone: *.target.com
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
    O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://portal.ruralmetro.com/,DanaInfo=NotesHQ.rmetro.com,SSL,CT=java+iNotes6W.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
    O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137552693953
    O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://217.197.149.13/activex/AMC.cab
    O16 - DPF: {81449547-EB5D-422E-8730-932DC5E412C8} (UVUPlayer Control) - http://downloads.dreamtank.com/uvuplayer_01i.cab
    O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
    O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://198.182.65.154/activex/AxisCamControl.cab
    O16 - DPF: {958FCAB0-616B-11D3-A63F-00001B322780} (TimetickerLittleHelpers.usfServer) - http://www.timeticker.com/Timeset/TcpServer.CAB
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://www.carilloncams.com/activex/AMC.cab
    O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://portal.ruralmetro.com/dana-cached/setup/JuniperSetup.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL,avgrsstx.dll,
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: fxsst.exe - Unknown owner - C:\WINDOWS\system32\fxsst.exe (file missing)
    O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: netrap.exe - Unknown owner - C:\WINDOWS\system32\netrap.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
    O23 - Service: OSCM Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
    O23 - Service: pyTivo - Unknown owner - C:\Python25\lib\site-packages\win32\PythonService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: TiVo.Net Auto-Transcoding Service - Pipkin Technologies - C:\Program Files\Pipkin Technologies\TiVo.Net\TiVoDotNet.exe
    O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    --
    End of file - 13289 bytes
     
    phxdonald,
    #6
  8. 2008/05/02
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi phxdonald

    I have a question here. and one comment.

    Did you add these to your trusted sites?
    O15 - Trusted Zone: *.myspace.com
    O15 - Trusted Zone: *.ruralmetro.com
    O15 - Trusted Zone: *.target.com

    I see you have P2P software ([color= "Red"] Limewire, BitTorrent uTorrent etc… [/color]) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

    References for the risk of these programs are here,
    here and here.

    I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

    Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at Windowsbbs Virus and Spyware removal.

    Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O23 - Service: fxsst.exe - Unknown owner - C:\WINDOWS\system32\fxsst.exe (file missing)
    O23 - Service: netrap.exe - Unknown owner - C:\WINDOWS\system32\netrap.exe (file missing)

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.

    Please reboot your computer and post a new HJT log.

    Let me know how things are running.

    Thanks
    Geri
     
    Geri,
    #7
  9. 2008/05/02
    phxdonald

    phxdonald Inactive Thread Starter

    Joined:
    2008/05/01
    Messages:
    6
    Likes Received:
    0
    I did add the ruralmetro.com address for VPN use, but I no longer need it. I removed all three entries. I have also removed BitTorrent, whihc I didn't even realize I still had installed. Finally I ran HijackThis and removed what you said. Here is the new log. Things seem to be running better.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:05:05 PM, on 5/2/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Python25\lib\site-packages\win32\PythonService.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe
    C:\Program Files\TiVo\Desktop\TiVoNotify.exe
    C:\Program Files\TiVo\Desktop\TiVoServer.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Microsoft Money Plus\MNYCoreFiles\mnybbsvc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.azcentral.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O1 - Hosts file is located at: C:\WINDOWS\System32\drivers\etc\hosts
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: Discover deskshop Browser Helper Object - {8DB3D69D-DA5E-4165-B781-72A761790672} - C:\WINDOWS\system32\BhoDshop.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" /service /registry /auto:TivoTransfer
    O4 - HKCU\..\Run: [TivoNotify] "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" /service /registry /auto:TivoNotify
    O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /registry /auto:TivoServer
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [MoneyBackgoundBanking] "C:\Program Files\Microsoft Money Plus\MNYCoreFiles\mnybbsvc.exe "
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Secure Online Account Numbers - {F74E75A5-96BF-40ef-A1C8-88EAEBB82AB6} - C:\Program Files\Secure Online Account Numbers\SOAN.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
    O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://portal.ruralmetro.com/,DanaInfo=NotesHQ.rmetro.com,SSL,CT=java+iNotes6W.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
    O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137552693953
    O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://217.197.149.13/activex/AMC.cab
    O16 - DPF: {81449547-EB5D-422E-8730-932DC5E412C8} (UVUPlayer Control) - http://downloads.dreamtank.com/uvuplayer_01i.cab
    O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
    O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://198.182.65.154/activex/AxisCamControl.cab
    O16 - DPF: {958FCAB0-616B-11D3-A63F-00001B322780} (TimetickerLittleHelpers.usfServer) - http://www.timeticker.com/Timeset/TcpServer.CAB
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://www.carilloncams.com/activex/AMC.cab
    O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://portal.ruralmetro.com/dana-cached/setup/JuniperSetup.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL,avgrsstx.dll,
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
    O23 - Service: OSCM Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
    O23 - Service: pyTivo - Unknown owner - C:\Python25\lib\site-packages\win32\PythonService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: TiVo.Net Auto-Transcoding Service - Pipkin Technologies - C:\Program Files\Pipkin Technologies\TiVo.Net\TiVoDotNet.exe
    O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    --
    End of file - 12643 bytes
     
    phxdonald,
    #8
  10. 2008/05/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi phxdonald

    OK your HJT log is looking OK.

    Lets get a on-line scan. Please do the following.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.


    Please do an online scan with Kaspersky WebScanner

    Click on "Accept" If your pop "“up blocker blocks the ActiveX download, allow it, click on "Accept" again

    You will be prompted to install an ActiveX component from Kaspersky, Click Yes or Install.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will start the program and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.

    Please post the Kaspersky results.

    Thanks
    Geri
     
    Geri,
    #9

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...