1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved anit spy check pop ups, slow computer, zone alarm disabled.

Discussion in 'Malware and Virus Removal Archive' started by mva5493, 2008/06/22.

  1. 2008/06/22
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    [Resolved] anit spy check pop ups, slow computer, zone alarm disabled.

    Zone Alarm is not disabled, avg 7.5 was disabled.

    The computer is a dell optiplex pentium 4, 2.8 ghz, running win xp, sp2. Also installed zone alarm, just updated avg 7.5 to avg 8.0. The pop ups started about a week ago, I just got the computer this am. I think I have removed the anti spy check (at least the pop ups aren't there anymore), have updated avg to 8.0 because 7.5 had been disabled and wouldn't open. I have also run downloaded and run deckard's, hjt, and atf here are the log files.
    Deckard's System Scanner v20071014.68
    Run by Administrator on 2008-06-22 09:57:20
    Computer is in Safe Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Failed to create restore point; computer is in safe mode.


    -- Last 5 Restore Point(s) --
    54: 2008-06-22 14:44:43 UTC - RP316 - Installed AVG Free 8.0
    53: 2008-06-22 14:36:20 UTC - RP315 - Installed AVG 7.5
    52: 2008-06-22 14:35:29 UTC - RP314 - Removed AVG 7.5
    51: 2008-06-22 14:14:10 UTC - RP313 - Removed Norton Security Scan
    50: 2008-06-21 01:59:02 UTC - RP312 - Software Distribution Service 3.0


    -- First Restore Point --
    1: 2008-04-27 20:49:15 UTC - RP263 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.

    Total Physical Memory: 254 MiB (512 MiB recommended).


    -- HijackThis (run as Administrator.exe) ---------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:59:21 AM, on 6/22/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Safe mode

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Desktop\dss.exe
    C:\DOCUME~1\ADMINI~1.ANN\Desktop\Administrator.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com
    R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://internetsearchservice.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://internetsearchservice.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://internetsearchservice.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://internetsearchservice.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://internetsearchservice.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://internetsearchservice.com
    R3 - Default URLSearchHook is missing
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: BellSouth Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
    O2 - BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll
    O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
    O2 - BHO: WarningBHO Class - {9989F1F6-70DE-4244-AC9F-6672983681A0} - C:\Program Files\AntiSpyCheck 2.1\IEWarning32.dll (file missing)
    O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O2 - BHO: (no name) - {A49E097A-D6EF-4B2F-8B0F-1230E998587F} - C:\Program Files\Web Technologies\iebt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: 238044 helper - {C0F371D7-926D-4700-B65E-63BFF1197205} - (no file)
    O3 - Toolbar: BellSouth Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
    O3 - Toolbar: Internet Service - {F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B} - C:\Program Files\Web Technologies\iebr.dll
    O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\bak\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\Run: [AntiSpyCheck 2.1] "C:\Program Files\AntiSpyCheck 2.1\AntiSpyCheck 2.1.exe "
    O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AUTORUN_VAL] C:\Program Files\AntiSpyCheck 2.1\AntiSpyCheck 2.1.exe
    O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\Web Technologies\wcs.exe
    O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files\Web Technologies\iebtm.exe
    O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
    O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
    O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iexplorergate.com/redirect.php (file missing)
    O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iexplorergate.com/redirect.php (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
    O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190596978000
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1190599165234
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O22 - SharedTaskScheduler: eulogical - {99f8405b-63d1-421a-83bb-7b4b0642ac28} - C:\WINDOWS\system32\funfsnv.dll
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: OneStep Search Service - OneStepSearch.net, Inc. - C:\Program Files\OneStepSearch\onestep.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

    --
    End of file - 9497 bytes

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    S1 OMCI - c:\windows\system32\drivers\omci.sys (file missing)


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    S2 OneStep Search Service - "c:\program files\onestepsearch\onestep.exe" "c:\program files\onestepsearch\onestep.dll" service <Not Verified; OneStepSearch.net, Inc.; OneStep Search>
    S2 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" <Not Verified; Viewpoint Corporation; Viewpoint Manager>


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Files created between 2008-05-22 and 2008-06-22 -----------------------------

    2008-06-22 09:45:53 0 d-------- C:\WINDOWS\system32\drivers\Avg
    2008-06-22 09:45:52 0 d-------- C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\AVGTOOLBAR
    2008-06-22 09:44:47 0 d-------- C:\Program Files\AVG
    2008-06-22 09:44:45 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
    2008-06-22 09:14:28 0 d-------- C:\WINDOWS\system32\appmgmt
    2008-06-21 13:25:03 1152 --a------ C:\WINDOWS\system32\windrv.sys
    2008-06-21 13:18:41 0 d-------- C:\Program Files\SpyNoMore
    2008-06-21 13:18:25 0 d-------- C:\Program Files\Common Files\Download Manager
    2008-06-18 15:42:15 0 d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
    2008-06-18 15:42:05 0 d-------- C:\WINDOWS\system32\238044
    2008-06-18 15:41:50 0 d-------- C:\Program Files\Web Technologies
    2008-06-18 14:28:57 0 d-------- C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\Southwest Airlines
    2008-06-18 14:28:30 0 d-------- C:\Program Files\Southwest Airlines
    2008-06-18 14:27:28 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-05-25 16:10:56 0 d-------- C:\WINDOWS\Sun
    2008-05-25 16:10:55 0 d-------- C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\Sun
    2008-05-25 16:09:57 0 d-------- C:\Program Files\Java
    2008-05-25 16:09:21 0 d-------- C:\Program Files\Common Files\Java


    -- Find3M Report ---------------------------------------------------------------

    2008-06-22 09:41:18 0 d-------- C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot
    2008-06-22 09:14:25 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-06-21 13:18:25 0 dr------- C:\Program Files\Common Files
    2008-06-18 14:28:31 13312 --a-s---- C:\WINDOWS\system32\funfsnv.dll
    2008-06-04 03:07:57 0 d-------- C:\Program Files\OneStepSearch


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]
    12/06/2007 10:57 AM 1156640 --a------ C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5AA2BA46-9913-4dc7-9620-69AB0FA17AE7}]
    11/30/2007 04:52 PM 622376 --a------ C:\Program Files\alot\bin\alot.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9989F1F6-70DE-4244-AC9F-6672983681A0}]
    C:\Program Files\AntiSpyCheck 2.1\IEWarning32.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
    06/22/2008 09:45 AM 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}]
    06/22/2008 09:38 AM 8192 --a------ C:\Program Files\Web Technologies\iebt.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C0F371D7-926D-4700-B65E-63BFF1197205}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B} "= C:\Program Files\Web Technologies\iebr.dll [06/18/2008 03:41 PM 86016]

    [-HKEY_CLASSES_ROOT\CLSID\{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09/06/2007 06:14 PM]
    "QuickTime Task "= "C:\Program Files\QuickTime\bak\qttask.exe" [10/10/2007 12:46 AM]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [05/25/2008 04:10 PM]
    "AntiSpyCheck 2.1 "= "C:\Program Files\AntiSpyCheck 2.1\AntiSpyCheck 2.1.exe" []
    "SNM "= "C:\Program Files\SpyNoMore\SNM.exe" [11/15/2007 06:02 AM]
    "AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/22/2008 09:44 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
    "Aim6 "=" " []
    "AUTORUN_VAL "= "C:\Program Files\AntiSpyCheck 2.1\AntiSpyCheck 2.1.exe" []

    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Start Menu\Programs\Startup\
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [6/22/2006 2:15:48 PM]
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [10/26/2006 10:24:54 PM]

    C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
    ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [4/27/2007 1:09:52 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
    "some "=C:\Program Files\Web Technologies\wcs.exe
    "start "=C:\Program Files\Web Technologies\iebtm.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{99f8405b-63d1-421a-83bb-7b4b0642ac28} "= C:\WINDOWS\system32\funfsnv.dll [06/18/2008 02:28 PM 13312]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "appinit_dlls "=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "




    -- End of Deckard's System Scanner: finished at 2008-06-22 09:59:49 ------------
     
    Last edited: 2008/06/22
    mva5493,
    #1
  2. 2008/06/22
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi Valerie :)

    Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in your next reply.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.


    Next I recommend you install Spybot Serch & Destroy, update, run a full scan and remove whatever it finds. Once complete, restart and run a fresh Deckard's scan in normal mode then post the log.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2008/06/22
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    Hi once again Dave:),
    Just curious, what is this computer infected with?
     
    mva5493,
    #3
  5. 2008/06/22
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Zlob, and some other common adware.
     
    noahdfear,
    #4
  6. 2008/06/22
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    here is the mbm log file in two parts (too big for one):eek:
    Malwarebytes' Anti-Malware 1.18
    Database version: 870

    2:17:53 PM 6/22/2008
    mbam-log-6-22-2008 (14-17-53).txt

    Scan type: Quick Scan
    Objects scanned: 46418
    Time elapsed: 17 minute(s), 42 second(s)

    Memory Processes Infected: 4
    Memory Modules Infected: 2
    Registry Keys Infected: 65
    Registry Values Infected: 26
    Registry Data Items Infected: 0
    Folders Infected: 57
    Files Infected: 245

    Memory Processes Infected:
    C:\Program Files\Web Technologies\wcm.exe (Trojan.Zlob) -> Unloaded process successfully.
    C:\Program Files\Web Technologies\wcs.exe (Trojan.Zlob) -> Unloaded process successfully.
    C:\Program Files\OneStepSearch\onestep.exe (Adware.OneStepSearch) -> Unloaded process successfully.
    C:\Program Files\OneStepSearch\onestep.exe (Adware.OneStepSearch) -> Unloaded process successfully.

    Memory Modules Infected:
    C:\WINDOWS\SYSTEM32\funfsnv.dll (Trojan.Zlob) -> Unloaded module successfully.
    C:\Program Files\OneStepSearch\onestep.dll (Adware.OneStepSearch) -> Unloaded module successfully.

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\CLSID\{99f8405b-63d1-421a-83bb-7b4b0642ac28} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{f99d0c20-f8e1-43b6-ab24-3f16bfaea77b} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{967a494a-6aec-4555-9caf-fa6eb00acf91} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{a8954909-1f0f-41a5-a7fa-3b376d69e226} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{202836d7-782e-468a-9958-4d529e7d69f5} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ec5bb7d4-9860-46d1-931c-c1a98e0e0e34} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c0f371d7-926d-4700-b65e-63bff1197205} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\iewarning32.warningbho (Rogue.AntiSpyCheck) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\iewarning32.warningbho.1 (Rogue.AntiSpyCheck) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{9989f1f6-70de-4244-ac9f-6672983681a0} (Rogue.AntiSpyCheck) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9989f1f6-70de-4244-ac9f-6672983681a0} (Rogue.AntiSpyCheck) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d2608046-dd09-a225-01bf-70c1edd8b2e8} (Rogue.AntiSpyCheck) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a49e097a-d6ef-4b2f-8b0f-1230e998587f} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a49e097a-d6ef-4b2f-8b0f-1230e998587f} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shoppingreport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\onestepsearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\alot (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\alotToolbar (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OneStep Search Service (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\AntiSpyCheck 2.1 (Rogue.AntiSpyCheck) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Web Technologies (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\e405.e405mgr (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{99f8405b-63d1-421a-83bb-7b4b0642ac28} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f99d0c20-f8e1-43b6-ab24-3f16bfaea77b} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{f99d0c20-f8e1-43b6-ab24-3f16bfaea77b} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\some (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiSpyCheck 2.1 (Rogue.AntiSpyCheck) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchURL (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\start (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Program Files\Web Technologies (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Program Files\ShoppingReport\Bin (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Program Files\ShoppingReport\Bin\2.0.26 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Program Files\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Program Files\OneStepSearch (Adware.OneStepSearch) -> Delete on reboot.
    C:\Program Files\alot (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Program Files\alot\bin (Adware.BHO) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\238044 (Trojan.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\report (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\BrowserSearch (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_0 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_1 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_10 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_11 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_2 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_3 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_4 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_5 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_6 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_7 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_8 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_9 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\configurator (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\ErrorSearch (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\postInstallLayout (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\products (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_0 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_0\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_1 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_1\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_2 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_2\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_3 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_3\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_5 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_5\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_6 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_6\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_7 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_7\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_8 (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_8\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\images (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\TimerManager (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\ToolbarSearch (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Updater (Adware.BHO) -> Quarantined and deleted successfully.
     
    mva5493,
    #5
  7. 2008/06/22
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    part two....
    Files Infected:
    C:\WINDOWS\SYSTEM32\funfsnv.dll (Trojan.Zlob) -> Delete on reboot.
    C:\Program Files\Web Technologies\iebr.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\iebtmm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\iebtu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\iebu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\myd.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\mym.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\myp.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\myv.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\wcm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\wcs.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\Web Technologies\wcu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
    C:\Program Files\alot\bin\alot.dll (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Program Files\ShoppingReport\Uninst.exe (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Program Files\OneStepSearch\home.js (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    C:\Program Files\OneStepSearch\onestep.dll (Adware.OneStepSearch) -> Delete on reboot.
    C:\Program Files\OneStepSearch\onestep.exe (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    C:\Program Files\OneStepSearch\osopt.exe (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    C:\Program Files\OneStepSearch\readme.html (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    C:\Program Files\OneStepSearch\uninstall.exe (Adware.OneStepSearch) -> Quarantined and deleted successfully.
    C:\Program Files\alot\alotUninst.exe (Adware.BHO) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\238044\238044.dll (Trojan.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\ShoppingReport\cs\res1\WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\toolbar.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\BrowserSearch\BrowserSearch.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\BrowserSearch\BrowserSearch.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_0\Button_0.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_0\Button_0.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_1\Button_1.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_1\Button_1.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_10\Button_10.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_10\Button_10.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_11\Button_11.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_11\Button_11.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_2\Button_2.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_2\Button_2.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_3\Button_3.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_3\Button_3.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_4\Button_4.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_4\Button_4.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_5\Button_5.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_5\Button_5.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_6\Button_6.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_6\Button_6.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_7\Button_7.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_7\Button_7.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_8\Button_8.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_8\Button_8.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_9\Button_9.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Button_9\Button_9.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\configurator\configurator.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\configurator\configurator.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\ErrorSearch\ErrorSearch.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\ErrorSearch\ErrorSearch.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\postInstallLayout\postInstallLayout.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\postInstallLayout\postInstallLayout.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\products\products.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\products\products.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_0\images\alot_icon_35x16.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_1\images\alot_search_24x16.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_2\images\default_210_default_233_alot_music_musicsearch.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_3\images\default_213_alot_music_lyrics_24x16.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\domains.dat (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\alert-icon.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\clear.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\cloudy.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\default_281_alot_weather_widget.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\foggy.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\frain.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG11E.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG125.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG127.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG12D.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG13.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG137.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG138.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG142.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG14D.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG166.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG175.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG17B.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG18.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG18E.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG191.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG19D.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG19E.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1A4.tmp (Adware.BHO) -> Quarantined and deleted successfully.
     
    mva5493,
    #6
  8. 2008/06/22
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    log file part three:
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1AA.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1B0.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1CA.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1CE.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1D3.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1E0.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1E1.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1EE.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG1FE.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG200.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG202.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG21F.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG226.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG23.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG237.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG24.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG245.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG248.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG24C.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG251.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG26.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG266.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG26D.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG277.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG289.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG29.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2A3.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2A6.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2B.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2B8.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2BC.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2C.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2CA.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2D4.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2DD.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2E.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2F.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2F1.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2FB.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2FC.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG2FF.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG30.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG31.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG312.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG31D.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG320.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG33C.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG33F.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG34.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG35.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG352.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG35C.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG363.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG368.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG3A.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG3AA.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG3E.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG3E9.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG3F.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG3F7.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG40.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG404.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG43.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG45.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG4D.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG53.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG54.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG54D.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG58C.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG5A.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG5CD.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG5D6.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG5DE.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG5E.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG62.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG65.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG651.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG690.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG6C7.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG71.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG749.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG75.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG753.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG77B.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG7E.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG7F.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG87.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG88.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG91.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMG92.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGA7.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGAC.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGAD.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGB1.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGB2.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGB7.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGBB.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGC6.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGCD.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGCF.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGD0.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGD2.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGD6.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGE8.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGF6.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\IMGFA.tmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\mcloud.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\na.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\nclear.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\ncloudy.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\nfoggy.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\nfrain.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\nhaze.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\nmcloud.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\nna.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\noicon.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\npcloud.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\nrain.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\nsnow.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\pcloud.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\rain.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\snow.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_4\images\tstorm.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_5\images\default_337_alot_music_news_24x16.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_6\images\default_220_alot_music_freemusic.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_7\images\default_215_alot_music_freeradio.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Button_8\images\default_444_alot_mrkt_napster.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\domains.dat (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\images\alot_brand.png (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\images\widget_bottom.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\images\widget_btnclose0.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\images\widget_btnclose1.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\images\widget_btnmin0.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\images\widget_btnmin1.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Resources\Shared\images\widget_caption.bmp (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\TimerManager\TimerManager.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\TimerManager\TimerManager.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\ToolbarSearch\ToolbarSearch.xml (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\ToolbarSearch\ToolbarSearch.xml.backup (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\alot\Updater\Updater.xml (Adware.BHO) -> Quarantined and deleted successfully.

    hopefully I didn't double post anything,:eek: pesky character limits...no, pesky infected files,;)
     
    mva5493,
    #7
  9. 2008/06/22
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    here is the dss main.txt after running spybot.
    Deckard's System Scanner v20071014.68
    Run by Administrator on 2008-06-22 22:55:58
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Percentage of Memory in Use: 80% (more than 75%).
    Total Physical Memory: 254 MiB (512 MiB recommended).


    -- HijackThis (run as Administrator.exe) ---------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:56:26 PM, on 6/22/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    C:\Program Files\SpyNoMore\SNM.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
    C:\Program Files\Southwest Airlines\Ding\Ding.exe
    C:\Program Files\Motorola Wireless\WU830G USB Adapter\OdHost.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Program Files\Motorola Wireless\WU830G USB Adapter\WLUSBCfg.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    c:\program files\aol\aim toolbar 5.0\AolTbServer.exe
    C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Desktop\dss.exe
    C:\DOCUME~1\ADMINI~1.ANN\Desktop\ADMINI~1.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R3 - Default URLSearchHook is missing
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: BellSouth Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
    O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O3 - Toolbar: BellSouth Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
    O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\bak\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
    O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: Motorola Wireless USB Adapter.lnk = ?
    O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190596978000
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1190599165234
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

    --
    End of file - 8035 bytes

    -- Files created between 2008-05-22 and 2008-06-22 -----------------------------

    2008-06-22 20:39:48 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
    2008-06-22 14:51:56 1044480 --a------ C:\WINDOWS\system32\ROBOEX32.DLL <Not Verified; eHelp Corporation.; RoboHelp for Word X4>
    2008-06-22 14:51:52 0 d-------- C:\Program Files\Motorola Wireless
    2008-06-22 14:51:51 94208 --a------ C:\WINDOWS\system32\W32N50CT.dll <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    2008-06-22 14:51:51 17142 --a------ C:\WINDOWS\system32\CBTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    2008-06-22 14:51:06 0 d-------- C:\Program Files\Funk Software
    2008-06-22 14:51:06 0 d-------- C:\Program Files\Common Files\Funk Software
    2008-06-22 13:45:39 0 d-------- C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\Malwarebytes
    2008-06-22 13:45:33 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-22 13:45:33 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
    2008-06-22 10:13:45 0 d--h----- C:\$AVG8.VAULT$
    2008-06-22 09:45:53 0 d-------- C:\WINDOWS\system32\drivers\Avg
    2008-06-22 09:45:52 0 d-------- C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\AVGTOOLBAR
    2008-06-22 09:44:47 0 d-------- C:\Program Files\AVG
    2008-06-22 09:44:45 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
    2008-06-22 09:14:28 0 d-------- C:\WINDOWS\system32\appmgmt
    2008-06-21 13:25:03 1152 --a------ C:\WINDOWS\system32\windrv.sys
    2008-06-21 13:18:41 0 d-------- C:\Program Files\SpyNoMore
    2008-06-21 13:18:25 0 d-------- C:\Program Files\Common Files\Download Manager
    2008-06-18 15:42:15 0 d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
    2008-06-18 14:28:57 0 d-------- C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\Southwest Airlines
    2008-06-18 14:28:30 0 d-------- C:\Program Files\Southwest Airlines
    2008-06-18 14:27:28 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-05-25 16:10:56 0 d-------- C:\WINDOWS\Sun
    2008-05-25 16:10:55 0 d-------- C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Application Data\Sun
    2008-05-25 16:09:57 0 d-------- C:\Program Files\Java
    2008-05-25 16:09:21 0 d-------- C:\Program Files\Common Files\Java


    -- Find3M Report ---------------------------------------------------------------

    2008-06-22 14:51:46 0 d--h----- C:\Program Files\InstallShield Installation Information
    2008-06-22 14:51:06 0 dr------- C:\Program Files\Common Files
    2008-06-22 10:49:07 0 d-------- C:\Program Files\QuickTime
    2008-06-22 09:14:25 0 d-------- C:\Program Files\Common Files\Symantec Shared


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
    06/22/2008 09:45 AM 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{A057A204-BACC-4D26-9990-79A187E2698E} "= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [06/22/2008 09:45 AM 2050816]

    [-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}]
    [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09/06/2007 06:14 PM]
    "QuickTime Task "= "C:\Program Files\QuickTime\bak\qttask.exe" [10/10/2007 12:46 AM]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [05/25/2008 04:10 PM]
    "SNM "= "C:\Program Files\SpyNoMore\SNM.exe" [11/15/2007 06:02 AM]
    "AVG8_TRAY "= "C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/22/2008 09:44 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
    "Aim6 "=" " []
    "SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM]

    C:\Documents and Settings\Administrator.ANNIE-4FJNCOGXG\Start Menu\Programs\Startup\
    DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [6/22/2006 2:15:48 PM]
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [10/26/2006 10:24:54 PM]

    C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
    Motorola Wireless USB Adapter.lnk - C:\Program Files\Motorola Wireless\WU830G USB Adapter\Startup.EXE [6/22/2008 2:51:53 PM]
    ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [4/27/2007 1:09:52 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "appinit_dlls "=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "




    -- End of Deckard's System Scanner: finished at 2008-06-22 22:57:22 ------------
     
    mva5493,
    #8
  10. 2008/06/22
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Wow! Looks Great :)

    You know the drill so I'll be brief. ;)


    Fix this one with HijackThis.

    R3 - Default URLSearchHook is missing


    Download and run ATF Cleaner by Atribune.

    Reboot and run a Kaspersky scan.
     
    noahdfear,
    #9
  11. 2008/06/23
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    yes I know the drill, ran atf, now running kapersky....time to watch and wait.....
     
    mva5493,
    #10
  12. 2008/06/24
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    I guess I should have known better than to think this computer was close to being done. :( I finally have a report from kapersky....after several failed attempts and lots of problems getting and staying online with this machine....
    here it is, although doesn't look like there is much to report:

    KASPERSKY ONLINE SCANNER 7 REPORT
    Tuesday, June 24, 2008
    Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Tuesday, June 24, 2008 17:28:04
    Records in database: 881342
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    A:\
    C:\
    D:\

    Scan statistics:
    Files scanned: 61251
    Threat name: 1
    Infected objects: 1
    Suspicious objects: 0
    Duration of the scan: 01:57:51


    File name / Threat name / Threats count
    C:\Deckard\System Scanner\20080622225550\backup\WINDOWS\temp\ONEBC.tmp\upgrade.exe Infected: not-a-virus:AdWare.Win32.OneStep.m 1

    The selected area was scanned.
     
    mva5493,
    #11
  13. 2008/06/25
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Not much at all. Delete the C:\Deckard folder and empty the recycle bin.

    Give me some details as to how the computer is behaving now and we'll see if we can sort it out.
     
    noahdfear,
    #12
  14. 2008/06/25
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    I deleted the deckard folder, as well as hjt and atf. There are no longer any pop ups, avg is installed and running, I ran kapersky again, as well as avg and no threats and or infections were found. It is logging on with no trouble and everything appears to be in working order. It is still a bit slow, but I think that is because it has only 256 mb of memory... I have again suggested a memory up grade, but not my computer so all I can do is suggest. (This is one I have fixed before, she just didn't keep up with updates. I have returned the computer, and unless you see something else I missed am finished with it. I also set new system restore points
     
    mva5493,
    #13
  15. 2008/06/25
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Ya done good Valerie :D :cool:
     
    noahdfear,
    #14
  16. 2008/06/25
    mva5493

    mva5493 Well-Known Member Thread Starter

    Joined:
    2007/01/29
    Messages:
    287
    Likes Received:
    0
    Thank you and as what seems to be becoming a pattern, thank you for you assistance on yet another one.nice working with you!:D
     
    Last edited: 2008/06/26
    mva5493,
    #15
  17. 2008/06/25
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    You are most welcome. :)
     
    noahdfear,
    #16

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...