Inactive [InActive] Web searches being redirected

every time i do a search and google and click a link, it diverts me to some random site unless i type in the actual URL.

anyone else seen this?

 

Hi AdmSirRed
Please do the following.

Please download RSIT.exe, Run a scan and post the logs in this thread.
Links and instructions here.

Thanks
Geri

 

Clicking to download it just gives a dead link. is there a working one?

 

Hi
OK please try this.

1. Click noahdfear's Rename ComboFix.
2. If it launches a file download dialog for download_file.exe from noahdfear.net, click Run.
3. download_file.vbs file should appear on the desktop, and shortly there-after a renamed copy of ComboFix.
4. Please note that the vbs file is recognized by some security programs as a Trojan-Downloader.JS and may try to block it. I assure you, the file is safe. So please allow it.
5. If successful, double click the renamed ComboFix and follow the prompts.

Please post the combofix log.

Thanks
Geri

 

it does not give me the option to run, all i can do is download the linked file, if i try to run from desktop i get an error. no renamed combofix appears

 

Hi
OK asked noahdfear to look here, please hang on for a bit.

Thanks

 

What is the error you get?

 

ok, thanks a lot for the help ill wait till then.

 

Hi
OK incase you did not see it, noahdfear asked what the error message was.

Thanks

 

Hi
OK please do this.
Delete the download_file.exe you downloaded earlier.

Now do this.

• Click here
• If it launches a file download dialog from noahdfear.net, click Run
• grab.vbs should appear on the desktop, and shortly there-after a renamed copy of ComboFix
• Please note that the vbs file is recognized by some security programs as a Trojan-Downloader.JS and may try to block it. I assure you, the file is safe. Please make sure your Antivirus allows it to run.
• If successful, shut down all open windows and programs, double click the renamed ComboFix and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Thanks
Geri

 

the error is " A connection with the server could not be established "

 

I'm going to send you a PM with some instructions that I'd rather stay out of public view.

 

Hi
OK please do as noahdfear asked.

Geri
Opps Sorry Dave

 

Well to start i don't have a file called "grab.vbs" what i did ahve however was "download_file" which contained the line you mentioned. i changed it useing both and yet got the same response and error.

 

Please check your PMs

 

Ok browser being buggy i guess i did not see a few posts, but i now got the renamed combo fix going from noahs last PM ill be running that next and posting results.

 

Great! Thanks for letting us know.

 

ComboFix 08-10-05.05 - Administrator 2008-10-06 2:33:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.686 [GMT -5:00]

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\ECURIT~1
C:\Documents and Settings\Administrator\Application Data\ICROSO~1
C:\Documents and Settings\Administrator\Application Data\ICROSO~1.NET
C:\Documents and Settings\Administrator\My Documents\CURITY~1
C:\Documents and Settings\Evryone\Cookies\evryone@edge.ru4[2].txt
C:\Program Files\Common Files\elitemediagroupoinuninstaller.exe
C:\Program Files\Common Files\icroso~1.net
C:\Program Files\smante~1
C:\Program Files\smbols~1
C:\Program Files\video activex object
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\ecurit~1
C:\WINDOWS\system32\TDSSadw.dll
C:\WINDOWS\system32\TDSSerrors.log
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\TDSSmain.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\TDSSserf1.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\wtscc.exe

.
((((((((((((((((((((((((( Files Created from 2008-09-06 to 2008-10-06 )))))))))))))))))))))))))))))))
.

2008-10-05 04:54 . 2008-10-05 16:58 <DIR> d-------- C:\Program Files\Security Task Manager
2008-10-05 04:54 . 2008-10-05 19:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-10-05 03:36 . 2008-10-05 03:36 244 --ah----- C:\sqmnoopt07.sqm
2008-10-05 03:36 . 2008-10-05 03:36 232 --ah----- C:\sqmdata07.sqm
2008-10-05 02:31 . 2008-10-05 02:31 244 --ah----- C:\sqmnoopt06.sqm
2008-10-05 02:31 . 2008-10-05 02:31 232 --ah----- C:\sqmdata06.sqm
2008-09-28 02:24 . 2008-09-28 02:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-28 02:23 . 2008-09-28 02:23 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-15 00:04 . 2008-09-15 00:04 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-09-15 00:04 . 2008-10-04 19:02 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-14 17:14 . 2008-09-14 17:14 244 --ah----- C:\sqmnoopt05.sqm
2008-09-14 17:14 . 2008-09-14 17:14 232 --ah----- C:\sqmdata05.sqm
2008-09-14 17:11 . 2008-09-14 17:11 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Yahoo!
2008-09-14 17:10 . 2008-09-14 17:07 39,424 --a------ C:\Documents and Settings\Administrator\xrt_wyqu.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-06 05:43 --------- d-----w C:\Program Files\Microsoft AntiSpyware
2008-09-30 21:05 90,112 ----a-w C:\WINDOWS\DUMP2673.tmp
2008-09-30 07:17 90,112 ----a-w C:\WINDOWS\DUMP1f6e.tmp
2008-09-30 07:16 90,112 ----a-w C:\WINDOWS\DUMP1aea.tmp
2008-09-30 06:45 90,112 ----a-w C:\WINDOWS\DUMP248f.tmp
2008-09-28 07:24 --------- d-----w C:\Program Files\Lavasoft
2008-09-28 07:24 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Lavasoft
2008-09-28 06:56 --------- d-----w C:\Program Files\Dl_cats
2008-09-27 22:26 --------- d-----w C:\Documents and Settings\Administrator\Application Data\uTorrent
2008-09-25 16:13 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-09-14 22:11 502,272 ----a-w C:\WINDOWS\system32\winlogon.exe
2008-09-14 22:11 295,424 ----a-w C:\WINDOWS\system32\termsrv.dll
2008-09-11 16:25 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DNA
2008-09-01 11:55 --------- d-----w C:\Documents and Settings\Administrator\Application Data\LimeWire
2008-08-30 09:16 --------- d-----w C:\Program Files\DNA
2008-08-25 09:21 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Yahoo!
2008-08-25 09:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-08-15 22:08 --------- d-----w C:\Program Files\uTorrent
2008-08-15 16:18 --------- d-----w C:\Program Files\DivX
2008-08-15 16:11 --------- d-----w C:\Program Files\XviD
2008-08-15 16:06 --------- d-----w C:\Program Files\QuickTime
2008-08-10 11:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\CCP
2008-08-05 22:02 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-08-05 22:02 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-08-05 22:00 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-08-05 22:00 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-08-05 21:59 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-08-05 21:59 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-08-05 21:59 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-08-05 21:59 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-08-05 21:59 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-08-05 21:59 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-08-05 21:59 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-08-05 21:59 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-08-05 21:58 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-08-05 21:58 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-08-05 21:58 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-08-05 21:58 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-08-05 21:58 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
2008-08-05 21:58 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-08-05 21:58 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-07-10 12:07 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-04-02 04:04 13,077 -c--a-w C:\Documents and Settings\Administrator\ZGUICFG.DAT
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
2005-07-22 03:49 13,077 -c--a-w C:\Documents and Settings\Administrator\ZGUICFGW.DAT
.

------- Sigcheck -------

2008-09-14 17:11 502272 9b1bd82bd0761b5ba986af66d2809c30 C:\WINDOWS\system32\winlogon.exe
2004-08-03 17:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\dllcache\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr "= "C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"PPWebCap "= "C:\Program Files\ScanSoft\PaperPort\PPWebCap.exe" [2000-03-01 48128]
"Aim6 "= "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" [2006-09-25 50736]
"Yahoo! Pager "= "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-07 4670968]
"Veoh "= "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-04-01 3587120]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "C:\WINDOWS\system32\igfxtray.exe" [2002-10-16 155648]
"HotKeysCmds "= "C:\WINDOWS\system32\hkcmd.exe" [2002-10-16 114688]
"gcasServ "= "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" [2004-12-31 469824]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 49152]
"DLCCCATS "= "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-06-07 69632]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-10-10 180269]
"AOLDialer "= "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"HostManager "= "C:\Program Files\Common Files\AOL\1135695861\ee\AOLSoftware.exe" [2006-09-25 50736]
"KEMailKb "= "C:\PROGRA~1\MICROI~1\INTERN~1\KEMailKb.EXE" [2005-08-09 401408]
"KPDrv4XP "= "C:\PROGRA~1\MICROI~1\INTERN~1\KPDrv4XP.EXE" [2005-02-21 40960]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-04-12 53408]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 86016]
"QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 267048]
"nwiz "= "nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe]
"SoundMan "= "SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr "= "C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-09-18 113664]
NETGEAR WG311v3 Smart Wizard.lnk - C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe [2006-01-26 1486848]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XJPG "= camfc.dll
"VIDC.D263 "= xl_x263dec.dll
"msacm.divxa32 "= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\LimeWire\\LimeWire 4.2.6 Pro\\LimeWire.exe "=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"C:\\Program Files\\Common Files\\AOL\\1135695861\\ee\\aolsoftware.exe "=
"C:\\Program Files\\Common Files\\AOL\\1135695861\\ee\\aim6.exe "=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
"C:\\Program Files\\eMule\\emule.exe "=
"C:\\Program Files\\Microsoft Games\\Halo\\halo.exe "=
"C:\\Program Files\\Steam\\SteamApps\\admsirred\\day of defeat source\\hl2.exe "=
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe "=
"C:\\Program Files\\Activision\\Star Trek - Armada\\Armada.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe "=
"C:\\Westwood\\RA2\\game.exe "=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe "=
"C:\\WINDOWS\\system32\\dplaysvr.exe "=
"C:\\WINDOWS\\system32\\sessmgr.exe "=
"C:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\sweaw.exe "=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
"C:\\Program Files\\MSN Messenger\\livecall.exe "=
"C:\\Program Files\\BitTornado\\btdownloadgui.exe "=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"C:\\Program Files\\Messenger\\msmsgs.exe "=
"C:\\Program Files\\LimeWire\\LimeWire.exe "=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe "=
"C:\\Program Files\\DNA\\btdna.exe "=
"C:\\Program Files\\Microsoft Games\\Freelancer\\EXE\\Freelancer.exe "=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe "=
"C:\\Program Files\\Warcraft III\\War3.exe "=
"C:\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe "=
"C:\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=
"C:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"C:\\Program Files\\uTorrent\\uTorrent.exe "=

R2 HIDKbFlt;HIDKbFlt.SvcDesc%;C:\WINDOWS\system32\DRIVERS\HIDKbFlt.sys [2005-07-25 23680]
R2 ppsio2;PPDevice;C:\WINDOWS\system32\drivers\ppsio2.sys [1999-04-01 22400]
R2 UMAXPCLS;Print Port Scanner Driver;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys [2001-08-17 22912]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S1 lusbaudio;Logitech USB Microphone;C:\WINDOWS\system32\drivers\OVSound2.sys [2001-08-17 25216]
S1 MupDump;MupDump;C:\WINDOWS\system32\drivers\mupmsfs.sys [ ]
S3 QCEmerald;Logitech QuickCam Web;C:\WINDOWS\system32\DRIVERS\OVCE.sys [2001-08-17 31872]
S3 XIRLINK;Gateway PC Camera;C:\WINDOWS\system32\DRIVERS\ucdnt.sys [2001-08-01 805808]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-10-04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-09-27 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Administrator.job
- C:\PROGRA~1\NORTON~1\Navw32.exe [2006-02-05 03:03]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-irssyncd - C:\WINDOWS\system32\irssyncd.exe
HKLM-Run-lphc5eqj0et3r - C:\WINDOWS\system32\lphc5eqj0et3r.exe
HKLM-Run-inrhc1eqj0et3r - C:\Documents and Settings\Administrator\Local Settings\Temp\.ttF.tmp.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\gvizocgt.default\
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-06 02:43:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCCCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\TDSSserv]
"imagepath "= "\systemroot\system32\drivers\TDSSserv.sys "
.
Completion time: 2008-10-06 2:57:00
ComboFix-quarantined-files.txt 2008-10-06 07:56:52

Pre-Run: 6,582,099,968 bytes free
Post-Run: 6,776,930,304 bytes free

229 --- E O F --- 2007-12-02 11:02:28


This is the first combo fix report, had no problems running it.

 

Hi
OK good, now please do this.

Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

Double click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select 'Perform Quick Scan', then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Post the entire report in your next reply.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Thanks
Geri

 

Malwarebytes' Anti-Malware 1.28
Database version: 1238
Windows 5.1.2600 Service Pack 2

10/7/2008 11:55:38 PM
mbam-log-2008-10-07 (23-55-38).txt

Scan type: Full Scan (C:\|)
Objects scanned: 177529
Time elapsed: 1 hour(s), 52 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\ieobject.ieobjectobj (Adware.WebDir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ieobject.ieobjectobj.1 (Adware.WebDir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{0b0a76e7-ade1-41f4-b157-559605721b3a} (Adware.WebDir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{50da37bb-7083-4fa7-80cf-de4cdb634166} (Adware.WebDir) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\eMule\LinkCreator.exe (Rogue.Fake!emule.exe) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9C5485AB-5415-4A41-8DD8-051B7CF3E732}\RP770\A0432946.scr (Fake.BlueScreenError) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\xrt_wyqu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogon.old (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.


Removed everything and had no hard to remove files.