Possible Browser Hijack?

I am posting this because my wife is getting some pop ups on her laptop. It is only happening in IE. I can use Firefox or Opera and no pop ups. I have run Ad-Aware 2007 and Spybot Search and Destroy scans to no avail. Norton Anti-Virus 9 finds nothing either. Below is my Hijack This! log file. Any help is appreciated. If any additional info is required please don't hesitate to ask for it. Thanks.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:04:55 PM, on 2/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netzero.net/
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe "
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1202266696471
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

 

Welcome to WindowsBBS jjds516

Your HijackThis log doesn't indicate a problem, but HJT is also limited in what it will show us. Let's grab a log with another tool. Download Deckard's System Scanner (dss.exe) and save it to your desktop.

• Close all applications and windows.
• Double click on dss.exe to run it and follow the prompts.
• When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.

Post the contents of both main.txt and extra.txt
You may need to put them in separate posts due to character count limitations in this forum.

Could you give a bit more detail about the popups please?

 

Thanks for the quick reply. The popups are all "Spyware Cleaner" products. It is a different product every time IE is opened. Below is the main.txt from DSS. There was no extra.txt. If you need anything else, please don't hesitate to ask. Thanks again.


Deckard's System Scanner v20071014.68
Run by Caitlyn's Mommy on 2008-02-24 12:48:04
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 79% (more than 75%).
Total Physical Memory: 511 MiB (512 MiB recommended).


-- HijackThis (run as Caitlyn's Mommy.exe) -------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:48:15 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Caitlyn's Mommy\Desktop\dss.exe
C:\HIJACK~1\Caitlyn's Mommy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netzero.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0F362E04-BEB9-4F6C-80A9-61673C0B8010} - (no file)
O2 - BHO: (no name) - {9A5CFCDA-21FE-473E-B5D7-35540DF5251E} - C:\WINDOWS\system32\pmnlk.dll
O2 - BHO: (no name) - {A8BB22EB-24C8-41A9-8260-B16CF26FD5A4} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {D85530E8-D39D-49D0-9F36-300D594556D2} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe "
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1202266696471
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: iifeeby - iifeeby.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 6531 bytes

-- Files created between 2008-01-24 and 2008-02-24 -----------------------------

2008-02-24 00:33:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-24 00:33:36 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-23 23:37:26 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-02-23 23:31:39 0 dr-h----- C:\Documents and Settings\Caitlyn's Mommy\Recent
2008-02-23 23:22:18 0 d-------- C:\HijackThis
2008-02-23 23:04:31 0 d-------- C:\Program Files\Trend Micro
2008-02-23 22:03:05 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-23 18:16:01 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-02-23 18:14:14 0 d-------- C:\WINDOWS\SHELLNEW
2008-02-23 18:12:45 0 d-------- C:\Program Files\Microsoft.NET
2008-02-23 18:10:27 0 dr-h----- C:\MSOCache
2008-02-23 17:02:06 1902 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-23 17:01:42 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-23 17:01:42 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-02-23 17:01:42 86016 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-02-23 17:01:42 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-02-23 17:01:42 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-02-23 17:01:42 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-23 17:00:28 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-02-23 17:00:28 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-02-23 17:00:28 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-02-23 17:00:28 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-02-23 17:00:28 0 d-------- C:\Documents and Settings\Administrator\My Documents
2008-02-23 17:00:28 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-02-23 17:00:28 0 d-------- C:\Documents and Settings\Administrator\Favorites
2008-02-23 17:00:28 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-02-23 17:00:28 0 d---s---- C:\Documents and Settings\Administrator\Cookies
2008-02-23 17:00:28 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-02-23 17:00:28 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-02-23 17:00:27 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-02-23 17:00:27 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-02-23 17:00:27 1835008 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-02-23 15:59:45 0 d-------- C:\Program Files\Symantec
2008-02-23 15:59:26 0 d-------- C:\Program Files\Symantec AntiVirus
2008-02-23 15:59:26 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-02-23 15:59:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-22 23:29:45 0 d-------- C:\WINDOWS\pss
2008-02-22 23:08:57 0 d-------- C:\Program Files\Lavasoft
2008-02-22 23:08:57 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-22 23:08:11 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-22 23:04:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-21 22:47:55 232126 --ahs---- C:\WINDOWS\system32\klnmp.ini2
2008-02-21 22:47:46 323072 --a------ C:\WINDOWS\system32\pmnlk.dll
2008-02-21 22:42:42 0 d-------- C:\WINDOWS\system32\nGpxx01
2008-02-21 22:42:42 0 d-------- C:\Temp
2008-02-18 20:36:34 0 d-------- C:\Program Files\Netflix
2008-02-16 16:10:50 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Shared
2008-02-16 16:10:47 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Incomplete
2008-02-16 16:10:31 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\.limewire
2008-02-14 11:29:45 0 d-------- C:\WINDOWS\Sun
2008-02-11 14:38:29 0 d-------- C:\Program Files\IrfanView
2008-02-09 20:47:38 0 d-------- C:\Program Files\LimeWire
2008-02-06 19:57:44 0 d-------- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2008-02-06 19:57:30 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\GameHouse
2008-02-06 19:57:27 0 d-------- C:\Program Files\GameHouse
2008-02-06 19:46:13 1158 --a------ C:\WINDOWS\mozver.dat
2008-02-06 19:39:59 0 d-------- C:\Program Files\CrossLoop
2008-02-06 11:58:28 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\acccore
2008-02-06 11:57:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-05 22:56:01 0 d-------- C:\Program Files\The Weather Channel FW
2008-02-05 22:53:29 0 d-------- C:\Program Files\CCleaner
2008-02-05 22:52:45 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\Adobe
2008-02-05 22:50:21 0 d-------- C:\Program Files\Yahoo!
2008-02-05 22:43:37 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\Google
2008-02-05 22:43:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Google
2008-02-05 22:43:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-05 22:43:14 0 d-------- C:\Program Files\Google
2008-02-05 22:42:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-02-05 22:42:18 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL
2008-02-05 22:42:18 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-02-05 22:42:04 0 d-------- C:\Program Files\Common Files\AOL
2008-02-05 22:41:39 0 d-------- C:\Program Files\AIM6
2008-02-05 22:30:02 0 d-------- C:\Program Files\Windows Media Connect 2
2008-02-05 22:28:58 0 d-------- C:\WINDOWS\system32\LogFiles
2008-02-05 22:28:58 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-02-05 22:24:45 0 d-------- C:\WINDOWS\RegisteredPackages
2008-02-05 22:05:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-02-05 22:02:00 0 d-------- C:\WINDOWS\system32\PreInstall
2008-02-05 22:01:58 0 d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 21:58:52 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-02-05 21:57:54 0 d---s---- C:\Documents and Settings\Caitlyn's Mommy\UserData
2008-02-05 21:32:50 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-05 21:32:47 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\Mozilla
2008-02-05 21:31:23 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\Macromedia
2008-02-05 21:20:46 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\U3
2008-02-05 21:13:52 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\Sun
2008-02-05 21:13:37 0 d-------- C:\Program Files\Java
2008-02-05 21:13:36 0 d-------- C:\Program Files\Common Files\Java
2008-02-05 21:13:11 32356 --a------ C:\WINDOWS\system32\pusbfd1.sys <Not Verified; Phoenix Technologies K.K.; USB FDD DRIVER>
2008-02-05 21:13:10 0 d-------- C:\swsetup
2008-02-05 21:12:58 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\Sonic
2008-02-05 21:12:57 0 d-------- C:\Program Files\Common Files\Sonic
2008-02-05 21:12:20 0 d-------- C:\Program Files\Common Files\SureThing Shared
2008-02-05 21:12:17 0 d-------- C:\Program Files\Sonic
2008-02-05 21:10:16 0 d-------- C:\Program Files\InterVideo
2008-02-05 21:09:06 0 d-------- C:\WINDOWS\system32\URTTemp
2008-02-05 21:08:49 0 d-------- C:\Program Files\HPQ
2008-02-05 21:08:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-02-05 21:07:47 0 d-------- C:\WINDOWS\nview
2008-02-05 21:07:08 0 d-------- C:\Program Files\AMD
2008-02-05 21:06:22 0 d-------- C:\WINDOWS\Options
2008-02-05 21:05:59 0 d-------- C:\Program Files\Apoint2K
2008-02-05 21:05:30 0 d-------- C:\WINDOWS\tiinst
2008-02-05 21:05:09 77824 --a------ C:\WINDOWS\system32\NVUninst.exe <Not Verified; NVIDIA; NVIDIA>
2008-02-05 21:05:06 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-02-05 21:04:22 30208 --a------ C:\WINDOWS\system32\wdmioctl.dll <Not Verified; Analog Devices Inc.; Analog Devices Inc. wdmioctl>
2008-02-05 21:04:22 1285632 --a------ C:\WINDOWS\system32\SMMedia.dll <Not Verified; Analog Devices; SoundMAX Integrated Digital Audio>
2008-02-05 21:04:21 978944 --a------ C:\WINDOWS\SynthCoreA.Dll <Not Verified; Analog Devices, Inc.; SoundMAX Wavetable>
2008-02-05 21:04:21 380928 --a------ C:\WINDOWS\SynCor.exe <Not Verified; Analog Devices, Inc.; SynthCore>
2008-02-05 21:04:20 45056 --a------ C:\WINDOWS\system32\SynthCore11Resources.dll <Not Verified; Analog Devices, Inc.; Analog Devices, Inc. SynthCore11Resources>
2008-02-05 21:04:20 40820 --a------ C:\WINDOWS\system32\Syncor11.dll <Not Verified; SoundMAX; Staccato Systems SynthCore R2.0 Synthesizer>
2008-02-05 21:04:20 49152 --a------ C:\WINDOWS\system32\S11thk32.dll <Not Verified; SoundMAX; Staccato Systems SynthCore R2.0 Synthesizer>
2008-02-05 21:04:19 0 d-------- C:\WINDOWS\VirtualEar
2008-02-05 21:04:19 765952 --a------ C:\WINDOWS\system\crlds3d.dll <Not Verified; Sensaura Ltd; Sensaura 3DPA>
2008-02-05 21:04:17 49152 --a------ C:\WINDOWS\system32\DSndUp.exe <Not Verified; Analog Devices Inc.; adi DSndUp>
2008-02-05 21:04:17 45056 --a------ C:\WINDOWS\system32\CleanUp.exe <Not Verified; adi; adi CleanUp>
2008-02-05 21:04:17 0 d-------- C:\Program Files\Analog Devices
2008-02-05 21:04:16 44 --a------ C:\WINDOWS\system32\msssc.dll
2008-02-05 21:04:16 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-02-05 21:04:13 0 d-------- C:\Program Files\Common Files\InstallShield
2008-02-05 21:03:23 0 d-------- C:\SYSTEM.SAV
2008-02-05 21:02:37 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\Identities
2008-02-05 21:02:29 0 d---s---- C:\Documents and Settings\Caitlyn's Mommy\Cookies
2008-02-05 21:02:29 0 dr-h----- C:\Documents and Settings\Caitlyn's Mommy\Application Data
2008-02-05 21:02:28 0 d--h----- C:\Documents and Settings\Caitlyn's Mommy\Templates
2008-02-05 21:02:28 0 dr------- C:\Documents and Settings\Caitlyn's Mommy\Start Menu
2008-02-05 21:02:28 0 dr-h----- C:\Documents and Settings\Caitlyn's Mommy\SendTo
2008-02-05 21:02:28 0 d--h----- C:\Documents and Settings\Caitlyn's Mommy\PrintHood
2008-02-05 21:02:28 2883584 --ah----- C:\Documents and Settings\Caitlyn's Mommy\NTUSER.DAT
2008-02-05 21:02:28 0 d--h----- C:\Documents and Settings\Caitlyn's Mommy\NetHood
2008-02-05 21:02:28 0 dr------- C:\Documents and Settings\Caitlyn's Mommy\My Documents
2008-02-05 21:02:28 0 d--h----- C:\Documents and Settings\Caitlyn's Mommy\Local Settings
2008-02-05 21:02:28 0 dr------- C:\Documents and Settings\Caitlyn's Mommy\Favorites
2008-02-05 21:02:28 0 d-------- C:\Documents and Settings\Caitlyn's Mommy\Desktop
2008-02-05 21:01:28 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-02-05 21:01:26 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-02-05 21:01:26 0 d-------- C:\WINDOWS\Prefetch
2008-02-05 21:01:24 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2008-02-05 21:01:24 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2008-02-05 21:01:24 0 d---s---- C:\Documents and Settings\LocalService\Cookies
2008-02-05 21:01:24 0 d-------- C:\Documents and Settings\LocalService\Application Data
2008-02-05 21:01:24 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2008-02-05 21:01:08 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2008-02-05 21:01:08 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
2008-02-05 21:01:08 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2008-02-05 21:01:08 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2008-02-05 21:01:07 262144 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2008-02-05 20:58:21 0 d-------- C:\WINDOWS\system32\xircom
2008-02-05 20:58:21 0 d-------- C:\Program Files\microsoft frontpage
2008-02-05 20:58:18 225280 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-02-05 20:58:09 0 -rahs---- C:\MSDOS.SYS
2008-02-05 20:58:09 0 -rahs---- C:\IO.SYS
2008-02-05 20:58:09 0 --a------ C:\CONFIG.SYS
2008-02-05 20:58:09 0 --a------ C:\AUTOEXEC.BAT
2008-02-05 20:56:54 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-02-05 20:56:42 0 dr------- C:\WINDOWS\Offline Web Pages
2008-02-05 20:56:41 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-02-05 20:56:28 0 d--h----- C:\Program Files\WindowsUpdate
2008-02-05 20:56:05 0 d-------- C:\WINDOWS\system32\DirectX
2008-02-05 20:55:40 0 d---s---- C:\WINDOWS\Tasks
2008-02-05 20:55:39 0 d-------- C:\Program Files\Common Files\MSSoap
2008-02-05 20:55:36 0 d-------- C:\WINDOWS\system32\Macromed
2008-02-05 20:55:36 0 d-------- C:\WINDOWS\srchasst
2008-02-05 20:55:29 0 d-------- C:\Program Files\Movie Maker
2008-02-05 20:55:24 0 d-------- C:\WINDOWS\system32\Restore
2008-02-05 20:55:08 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-02-05 20:54:44 0 d-------- C:\WINDOWS\Registration
2008-02-05 20:54:12 0 d-------- C:\Program Files\Online Services
2008-02-05 20:54:06 0 d-------- C:\Program Files\Messenger
2008-02-05 20:54:03 0 d-------- C:\Program Files\MSN Gaming Zone
2008-02-05 20:53:33 0 d-------- C:\Program Files\Windows NT
2008-02-05 20:53:31 0 d-------- C:\WINDOWS\system32\MsDtc
2008-02-05 20:53:30 0 d-------- C:\WINDOWS\system32\Com
2008-02-05 15:43:43 0 d--hs---- C:\WINDOWS\Installer
2008-02-05 15:43:42 0 d-------- C:\Program Files\Common Files\ODBC
2008-02-05 15:43:39 0 dr------- C:\Program Files
2008-02-05 15:43:39 0 d-------- C:\Program Files\Common Files
2008-02-05 15:43:39 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-02-05 15:42:13 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-02-05 15:42:13 0 dr------- C:\Documents and Settings\Default User\Start Menu
2008-02-05 15:42:13 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2008-02-05 15:42:13 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-02-05 15:42:13 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-02-05 15:42:13 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-02-05 15:42:13 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-02-05 15:42:13 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2008-02-05 15:42:13 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-02-05 15:42:13 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-02-05 15:42:13 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-02-05 15:42:13 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-02-05 15:42:13 0 dr------- C:\Documents and Settings\All Users\Start Menu
2008-02-05 15:42:13 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-02-05 15:42:13 0 dr------- C:\Documents and Settings\All Users\Documents
2008-02-05 15:42:13 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-02-05 15:41:59 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-02-05 15:41:59 0 d-------- C:\WINDOWS\system32\CatRoot
2008-02-05 15:41:54 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2008-02-05 15:41:54 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-02-05 15:41:54 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2008-02-05 15:41:54 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-02-05 15:41:31 0 d-------- C:\Documents and Settings
2008-02-05 15:41:30 0 d--hs---- C:\System Volume Information
2008-02-05 15:35:18 0 d-------- C:\WINDOWS
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\WinSxS
2008-02-05 15:35:18 0 dr------- C:\WINDOWS\Web
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\twain_32
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\wins
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\wbem
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\usmt
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\spool
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\ShellExt
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\Setup
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\ras
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\oobe
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\npp
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\mui
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\inetsrv
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\IME
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\icsxml
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\ias
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\export
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\drivers
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-02-05 15:35:18 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\dhcp
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\config
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\3076
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\2052
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\1054
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\1042
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\1041
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\1037
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\1033
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\1031
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\1028
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system32\1025
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\system
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\security
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Resources
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\repair
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Provisioning
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\PeerNet
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\pchealth
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\mui
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\msapps
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\msagent
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Media
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\java
2008-02-05 15:35:18 0 d--h----- C:\WINDOWS\inf
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\ime
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Help
2008-02-05 15:35:18 0 dr--s---- C:\WINDOWS\Fonts
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Driver Cache
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Debug
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Cursors
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Connection Wizard
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\Config
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\AppPatch
2008-02-05 15:35:18 0 d-------- C:\WINDOWS\addins


-- Find3M Report ---------------------------------------------------------------

2008-02-05 15:42:13 62 --ahs---- C:\Documents and Settings\Caitlyn's Mommy\Application Data\desktop.ini


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F362E04-BEB9-4F6C-80A9-61673C0B8010}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9A5CFCDA-21FE-473E-B5D7-35540DF5251E}]
02/21/2008 10:47 PM 323072 --a------ C:\WINDOWS\system32\pmnlk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8BB22EB-24C8-41A9-8260-B16CF26FD5A4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D85530E8-D39D-49D0-9F36-300D594556D2}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [08/04/2004 07:00 AM]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [08/04/2004 07:00 AM]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [08/04/2004 07:00 AM]
"Apoint "= "C:\Program Files\Apoint2K\Apoint.exe" [10/08/2003 01:40 PM]
"AGRSMMSG "= "AGRSMMSG.exe" [09/03/2004 10:52 PM C:\WINDOWS\AGRSMMSG.exe]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [04/08/2004 05:22 AM]
"nwiz "= "nwiz.exe" [04/08/2004 05:22 AM C:\WINDOWS\system32\nwiz.exe]
"Cpqset "= "C:\Program Files\HPQ\Default Settings\cpqset.exe" [03/01/2004 01:05 PM]
"UpdateManager "= "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [08/19/2003 01:01 AM]
"SunJavaUpdateSched "= "C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [06/03/2004 10:05 PM]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [02/29/2004 04:44 PM]
"vptray "= "C:\PROGRA~1\SYMANT~1\VPTray.exe" [03/12/2004 03:18 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DW4 "= "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [12/20/2007 08:10 AM]
"Aim6 "= "C:\Program Files\AIM6\aim6.exe" [01/03/2008 11:15 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2/5/2008 10:43:15 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifeeby]
iifeeby.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages "= msv1_0 C:\WINDOWS\system32\pmnlk.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\LaunchU3.exe -a




-- End of Deckard's System Scanner: finished at 2008-02-24 12:49:45 ------------

 

Download ComboFix by sUBs from here, saving the file to your desktop.

It's best disable realtime protection applications as they sometime interfere with the tool. Check this link for your applicable programs.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

 

Dave -- Please see the requested logs below. The first is the ComboFix log and the second is the HJT log. Thanks again.


ComboFix 08-02-25.3 - Caitlyn's Mommy 2008-02-25 19:18:42.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.213 [GMT -5:00]
Running from: C:\Documents and Settings\Caitlyn's Mommy\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Caitlyn's Mommy\Desktop\MalwareAlarm.lnk
C:\WINDOWS\system32\klnmp.ini
C:\WINDOWS\system32\klnmp.ini2
C:\WINDOWS\system32\msssc.dll
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\pmnlk.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.

2008-02-25 15:21 . 2008-02-25 15:22 218 --a------ C:\WINDOWS\wininit.ini
2008-02-24 20:58 . 2008-02-24 20:58 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-02-24 20:58 . 2008-02-24 20:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision
2008-02-24 20:54 . 2008-02-24 20:56 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-24 13:34 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-24 00:33 . 2008-02-24 00:33 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-24 00:33 . 2008-02-24 00:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-23 23:37 . 2008-02-24 00:11 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-23 23:37 . 2008-02-23 23:37 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-23 23:37 . 2008-02-23 23:37 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-23 23:37 . 2008-02-23 23:37 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-23 23:22 . 2008-02-25 14:58 <DIR> d-------- C:\HijackThis
2008-02-23 23:04 . 2008-02-23 23:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-23 22:03 . 2008-02-23 22:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-23 18:22 . 2008-02-23 18:22 376 --a------ C:\WINDOWS\ODBC.INI
2008-02-23 18:21 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-02-23 18:16 . 2008-02-23 18:16 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-02-23 18:14 . 2008-02-23 18:16 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-02-23 18:12 . 2008-02-23 18:12 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-23 18:10 . 2008-02-23 18:10 <DIR> dr-h----- C:\MSOCache
2008-02-23 17:02 . 2008-02-23 17:14 1,902 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-23 17:01 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-23 17:01 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-23 17:01 . 2008-02-22 18:44 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-23 17:01 . 2008-02-08 10:37 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-23 17:01 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-23 17:01 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-23 16:37 . 2008-02-23 16:37 0 --a------ C:\WINDOWS\VPC32.INI
2008-02-23 16:00 . 2004-03-04 23:46 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-02-23 16:00 . 2004-03-04 23:46 82,832 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-02-23 15:59 . 2008-02-25 19:23 <DIR> d-------- C:\Program Files\Symantec AntiVirus
2008-02-23 15:59 . 2008-02-23 16:01 <DIR> d-------- C:\Program Files\Symantec
2008-02-23 15:59 . 2008-02-23 23:57 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-02-23 15:59 . 2008-02-23 15:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-22 23:08 . 2008-02-22 23:08 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-22 23:08 . 2008-02-22 23:08 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-22 23:08 . 2008-02-22 23:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-22 23:04 . 2008-02-24 00:00 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-22 23:04 . 2008-02-22 23:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-21 22:42 . 2008-02-25 18:46 <DIR> d-------- C:\Temp
2008-02-18 20:36 . 2008-02-18 20:36 <DIR> d-------- C:\Program Files\Netflix
2008-02-16 17:42 . 2008-02-16 17:42 360,064 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-02-16 16:10 . 2008-02-24 21:02 <DIR> d-------- C:\Documents and Settings\Caitlyn's Mommy\Shared
2008-02-16 16:10 . 2008-02-24 21:03 <DIR> d-------- C:\Documents and Settings\Caitlyn's Mommy\Incomplete
2008-02-16 16:10 . 2008-02-23 15:56 <DIR> d-------- C:\Documents and Settings\Caitlyn's Mommy\.limewire
2008-02-14 11:29 . 2008-02-14 11:29 <DIR> d-------- C:\WINDOWS\Sun
2008-02-11 14:38 . 2008-02-11 14:38 <DIR> d-------- C:\Program Files\IrfanView
2008-02-06 19:57 . 2008-02-06 19:57 <DIR> d-------- C:\Program Files\GameHouse
2008-02-06 19:57 . 2008-02-06 19:57 <DIR> d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\GameHouse
2008-02-06 19:57 . 2008-02-06 19:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2008-02-06 19:46 . 2008-02-06 19:46 1,158 --a------ C:\WINDOWS\mozver.dat
2008-02-06 19:39 . 2008-02-06 20:35 <DIR> d-------- C:\Program Files\CrossLoop
2008-02-06 11:58 . 2008-02-06 11:58 <DIR> d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\acccore
2008-02-06 11:57 . 2008-02-06 11:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-05 22:56 . 2008-02-05 22:56 <DIR> d-------- C:\Program Files\The Weather Channel FW
2008-02-05 22:56 . 2007-12-20 08:10 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-02-05 22:56 . 2007-12-20 08:10 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-02-05 22:53 . 2008-02-05 22:53 <DIR> d-------- C:\Program Files\CCleaner
2008-02-05 22:50 . 2008-02-05 22:51 <DIR> d-------- C:\Program Files\Yahoo!
2008-02-05 22:43 . 2008-02-23 23:57 <DIR> d-------- C:\Program Files\Google
2008-02-05 22:43 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-05 22:42 . 2008-02-05 22:42 <DIR> d-------- C:\Program Files\Common Files\AOL
2008-02-05 22:42 . 2008-02-23 23:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-02-05 22:42 . 2008-02-05 22:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-02-05 22:42 . 2008-02-05 22:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL
2008-02-05 22:41 . 2008-02-23 23:55 <DIR> d-------- C:\Program Files\AIM6
2008-02-05 22:41 . 2008-02-05 22:42 536 --ah----- C:\IPH.PH
2008-02-05 22:30 . 2008-02-05 22:30 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-02-05 22:28 . 2008-02-24 20:49 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-05 22:28 . 2008-02-05 22:29 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-02-05 22:25 . 2004-08-04 07:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-05 22:01 . 2008-02-23 22:50 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 22:01 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-05 21:58 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-02-05 21:58 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-02-05 21:58 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-02-05 21:58 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-02-05 21:58 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-02-05 21:57 . 2008-02-05 21:57 <DIR> d---s---- C:\Documents and Settings\Caitlyn's Mommy\UserData
2008-02-05 21:32 . 2008-02-05 21:32 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-05 21:20 . 2008-02-24 20:50 <DIR> d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\U3
2008-02-05 21:20 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-02-05 21:13 . 2008-02-05 21:13 <DIR> d-------- C:\swsetup
2008-02-05 21:13 . 2008-02-24 13:55 <DIR> d-------- C:\Program Files\Java
2008-02-05 21:13 . 2008-02-05 21:13 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-05 21:13 . 2002-10-15 10:13 32,356 --a------ C:\WINDOWS\system32\pusbfd1.sys
2008-02-05 21:13 . 2002-10-15 10:13 26,629 --a------ C:\WINDOWS\system32\pusbfd2.vxd
2008-02-05 21:13 . 2008-02-05 21:13 1,606 -rahs---- C:\WINDOWS\system32\drivers\103C_HP_NTBK_Pavilion zv5200 (PR465UA#ABA)_YN_0Pavi_QCND509039G_EU_46_I08A0_SCompal_V32.42_BF.35_T050428_WXH2_L409_M512_J60_7AMD_8Athlon 64_91.8_#080205_N10EC8139_(PR465UA#ABA)_XMOBILE_CN10_Z10DE00D9_2F.35.MRK
2008-02-05 21:12 . 2008-02-05 21:12 <DIR> d-------- C:\Program Files\Sonic
2008-02-05 21:12 . 2008-02-05 21:12 <DIR> d-------- C:\Program Files\Common Files\SureThing Shared
2008-02-05 21:12 . 2008-02-05 21:12 <DIR> d-------- C:\Program Files\Common Files\Sonic
2008-02-05 21:12 . 2008-02-05 21:12 <DIR> d-------- C:\Documents and Settings\Caitlyn's Mommy\Application Data\Sonic
2008-02-05 21:12 . 2008-02-05 21:12 108,544 --a------ C:\WINDOWS\system32\pxcpyi64.exe
2008-02-05 21:12 . 2008-02-05 21:12 103,936 --a------ C:\WINDOWS\system32\pxinsi64.exe
2008-02-05 21:12 . 2004-08-12 10:26 15,669 --a------ C:\WINDOWS\system32\oeminfo.ini
2008-02-05 21:10 . 2008-02-05 21:10 <DIR> d-------- C:\Program Files\InterVideo
2008-02-05 21:09 . 2008-02-05 21:09 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-05 21:08 . 2008-02-05 21:13 <DIR> d-------- C:\Program Files\HPQ
2008-02-05 21:08 . 2004-08-05 04:05 341,760 --a------ C:\WINDOWS\system32\drivers\BCMWL5.SYS
2008-02-05 21:08 . 2004-08-05 04:05 139,264 --a------ C:\WINDOWS\system32\BCMWLU00.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-16 22:42 360,064 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2008-02-06 02:13 1,606 --sha-r C:\WINDOWS\system32\drivers\103C_HP_NTBK_Pavilion zv5200 (PR465UA#ABA)_YN_0Pavi_QCND509039G_EU_46_I08A0_SCompal_V32.42_BF.35_T050428_WXH2_L409_M512_J60_7AMD_8Athlon 64_91.8_#080205_N10EC8139_(PR465UA#ABA)_XMOBILE_CN10_Z10DE00D9_2F.35.MRK
2008-02-06 02:12 20,576 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-02-06 01:58 --------- d-----w C:\Program Files\microsoft frontpage
.

------- Sigcheck -------

482ab7f9cd41702e8f856c11cfefb02d C:\WINDOWS\system32\drivers\tcpip.sys
----a-w 360,832 2007-10-30 16:53:32 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
-c----w 359,040 2004-08-04 12:00:00 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
-c--a-w 360,064 2008-02-16 22:42:36 C:\WINDOWS\system32\dllcache\TCPIP.SYS
----a-w 360,064 2008-02-16 22:42:36 C:\WINDOWS\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DW4 "= "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [2007-12-20 08:10 715888]
"Aim6 "= "C:\Program Files\AIM6\aim6.exe" [2008-01-03 11:15 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 07:00 208952]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 07:00 455168]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 07:00 455168]
"Apoint "= "C:\Program Files\Apoint2K\Apoint.exe" [2003-10-08 13:40 159744]
"AGRSMMSG "= "AGRSMMSG.exe" [2004-09-03 22:52 88363 C:\WINDOWS\AGRSMMSG.exe]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2004-04-08 05:22 4730880]
"nwiz "= "nwiz.exe" [2004-04-08 05:22 323584 C:\WINDOWS\system32\nwiz.exe]
"Cpqset "= "C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-03-01 13:05 200766]
"UpdateManager "= "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 01:01 110592]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44 66680]
"vptray "= "C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18 124128]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-02-24 20:56:16 113664]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-02-05 22:43:15 125624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifeeby]
iifeeby.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
"C:\\Program Files\\CrossLoop\\CrossLoopConnect.exe "=

S4 Aud355620mn;Aud355620mn;C:\WINDOWS\system32\BCMWLD2K.EXE [2004-08-05 04:05]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 19:23:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????7?0?7?5??`???? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\AIM6\aolsoftware.exe
.
**************************************************************************
.
Completion time: 2008-02-25 19:25:04 - machine was rebooted [Caitlyn's Mommy]
ComboFix-quarantined-files.txt 2008-02-26 00:24:54
.
2008-02-24 03:08:16 --- E O F ---




THIS IS THE BEGINNING OF THE HJT LOG!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:28, on 2/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netzero.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe "
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} - http://scanner2.malware-scan.com/setup/webinst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1202266696471
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: iifeeby - iifeeby.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 6561 bytes

 

Scan again with HijackThis and place a check next to the following entry, then click Fix Checked.

O20 - Winlogon Notify: iifeeby - iifeeby.dll (file missing)


Close HijackThis

Delete the following folder.

C:\Program Files\microsoft frontpage

Download ATF Cleaner by Atribune and save it to your Desktop.

• Double click ATF-Cleaner.exe to run the program.
• Check the boxes to the left of:
  
  
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Java Cache
  • Recycle bin
  
  
• The rest are optional - if you want it to remove everything check "Select All ".
• Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.

Reboot

Now do an online scan with Kaspersky WebScanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Extended (if available otherwise Standard)
  • Scan Options:
  • Scan Archives
    Scan Mail Bases
• Click OK
• Now under select a target to scan:
  • Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.

Post the Kaspersky log and one more fresh HijackThis log.

 

Dave,

Done with what you asked. Please see the logs below. First is the Kaspersky log and then the HJT log.


KASPERSKY LOG-----

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, February 26, 2008 12:16:15 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 26/02/2008
Kaspersky Anti-Virus database records: 581221
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 31561
Number of viruses found: 4
Number of infected objects: 8
Number of suspicious objects: 0
Duration of the scan process: 00:29:49

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0000.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06F00000.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540000.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\Caitlyn's Mommy\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Caitlyn's Mommy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Caitlyn's Mommy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Caitlyn's Mommy\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Caitlyn's Mommy\Local Settings\History\History.IE5\MSHist012008022520080226\index.dat Object is locked skipped
C:\Documents and Settings\Caitlyn's Mommy\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Caitlyn's Mommy\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Caitlyn's Mommy\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\CrossLoop\VNCHooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b skipped
C:\Program Files\CrossLoop\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h skipped
C:\QooBox\Quarantine\catchme2008-02-25_192316.15.zip/pmnlk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-25_192316.15.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{FE5F9ED5-D247-4AB8-9C70-139011134F30}\RP1\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Downloaded Program Files\webinst.dll Infected: not-virus:Hoax.Win32.Renos.asm skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{8F96441D-F740-4993-BD50-2EAC026C5D1B}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.



HJT LOG------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:17:52 AM, on 2/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\System32\svchost.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netzero.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} - http://scanner2.malware-scan.com/setup/webinst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1202266696471
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 5867 bytes

 

Looks pretty good.

Delete the following file.

C:\WINDOWS\Downloaded Program Files\webinst.dll

Now open your Symantec antivirus interface and delete all quarantined items.

Empty the recycle bin.

Once done, we can tidy up. Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.

Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.


How's the computer performing after doing all of the above?

 

Dave,

First and foremost, I want to thank you for all of your hard work. The laptop is running better as of now and pop ups have not returned. I am going to keep this thread open until the weekend just to make sure but I don't anticipate them to come back. Thanks again!!

James

 

That's great news, James. You're very welocme. Glad I could help!

I'll mark this topic resolved after the weekend then, unless I hear otherwise from you. Geri has posted some very helpful information and recommendations regarding future protection in the following link.

http://www.windowsbbs.com/showthread.php?t=67958

Surf safe!