Solved Unsolicited virus alert popup

[Resolved] Unsolicited virus alert popup

Had a virus alert from System Alert popup, closed out System Alert iMalwarebytes' Anti-Malware 1.34
Database version: 1779
Windows 5.1.2600 Service Pack 3

2/19/2009 3:03:06 PM
mbam-log-2009-02-19 (15-03-06).txt

Scan type: Quick Scan
Objects scanned: 72350
Time elapsed: 7 minute(s), 4 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 4
Registry Keys Infected: 138
Registry Values Infected: 8
Registry Data Items Infected: 0
Folders Infected: 18
Files Infected: 85

Memory Processes Infected:
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Unloaded process successfully.

Memory Modules Infected:
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MSN Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\funwebproducts.datacontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b813095c-81c0-4e40-aa14-67520372b987} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cff4ce82-3aa2-451f-9b77-7165605fb835} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8e6f1832-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a9571378-68a1-443d-b082-284f960c6d17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{938aa51a-996c-4884-98ce-80dd16a5c9da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d9fffb27-d62a-4d64-8cec-1ff006528805} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mywebsearchservice (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\mywebsearchservice (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mywebsearchservice (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch email plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch email plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\my web search bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\zango 10.3.75.0 (Adware.Zango) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\Avatar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MSN Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\msimg32.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\03F5F86A (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\03F5FCBF (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\03F5FFDC.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\03F604DE.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\03F606F1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\03F60868.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\03F60A1D (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\04561DC2.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\04562042.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\04562301.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\045624A7.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\Cache\WebfettiBtn.html (Adware.MyWebSearch) -> Quarantined and deleted successfully.
mmediately. Ran Malwarebytes

 

DDS Log
DDS (Ver_09-02-01.01) - NTFSx86
Run by dee at 15:09:51.92 on Thu 02/19/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.369 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated)
FW: McAfee Personal Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\StacSV.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\AOL\1213497838\ee\AOLSoftware.exe
C:\Program Files\Norton Ghost\Agent\VProTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AOL 9.1\waol.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Documents and Settings\dee\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant =
uURLSearchHooks: RadarSync Toolbar: {399d96ca-6f9a-4fff-95fe-284e45ebb935} - c:\program files\radarsync\tbRad1.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RadarSync Toolbar: {399d96ca-6f9a-4fff-95fe-284e45ebb935} - c:\program files\radarsync\tbRad1.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: RadarSync Toolbar: {399d96ca-6f9a-4fff-95fe-284e45ebb935} - c:\program files\radarsync\tbRad1.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No File
EB: {2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [<NO NAME>]
uRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe "
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [HostManager] c:\program files\common files\aol\1213497838\ee\AOLSoftware.exe
mRun: [Norton Ghost 14.0] "c:\program files\norton ghost\agent\VProTray.exe "
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe "
mRun: [Lexmark X6100 Series] "c:\program files\lexmark x6100 series\lxbfbmgr.exe "
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html
IE: &Search
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: Open with WordPerfect - c:\program files\wordperfect office x3\programs\WPLauncher.hta
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,77,65,62,5c,72,65,6c-,61,74,65,64,2e,68,74,6d,00
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file://c:\program files\book of legends\images\stg_drm.ocx
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file://c:\program files\masters of mystery - crime of fashion\images\armhelper.ocx
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
Notify: LMIinit - LMIinit.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dee\applic~1\mozilla\firefox\profiles\1fpt3l0j.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - plugin: c:\documents and settings\dee\application data\mozilla\firefox\profiles\1fpt3l0j.default\extensions\npmozax@real.com\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPMyWebS.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npracplug.dll
FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-1-9 213640]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-1-23 47640]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-2-19 203280]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-2-19 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-2-19 144704]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-2-19 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-2-19 79304]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-2-19 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-2-19 40552]
R3 SymSnapService;SymSnapService;c:\program files\norton ghost\shared\drivers\SymSnapService.exe [2007-12-20 1553896]
S0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [2008-6-14 3456]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-2-19 34216]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

============== File Associations ===============

regfile=regedit.exe "%1" %*
scrfile= "%1" %*

=============== Created Last 30 ================

2009-02-19 10:00 <DIR> --d----- c:\docume~1\dee\applic~1\TMInc
2009-02-19 00:16 7,225 a------- c:\windows\system32\Config.MPF
2009-02-19 00:11 40,552 a------- c:\windows\system32\drivers\mfesmfk.sys
2009-02-19 00:11 79,304 a------- c:\windows\system32\drivers\mfeavfk.sys
2009-02-19 00:11 35,272 a------- c:\windows\system32\drivers\mfebopk.sys
2009-02-19 00:11 120,136 a------- c:\windows\system32\drivers\Mpfp.sys
2009-02-19 00:10 <DIR> --d----- c:\program files\common files\McAfee
2009-02-19 00:10 <DIR> --d----- c:\program files\McAfee.com
2009-02-19 00:09 <DIR> --d----- c:\program files\McAfee
2009-02-19 00:06 34,216 a------- c:\windows\system32\drivers\mferkdk.sys
2009-02-18 23:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-02-18 13:26 90,112 a------- c:\windows\unvise32.exe
2009-02-18 13:26 <DIR> --d----- c:\program files\Jewels of Sinai
2009-02-17 17:05 <DIR> --d----- c:\program files\Hide & Secret 2 - Cliffhanger Castle
2009-02-17 01:59 <DIR> --d----- c:\program files\Oberon Media
2009-02-14 16:59 <DIR> --d----- c:\docume~1\dee\applic~1\URSE Games
2009-02-13 14:02 <DIR> --d----- c:\docume~1\dee\applic~1\Flood Light Games
2009-02-13 14:02 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Flood Light Games
2009-02-13 12:09 <DIR> --d----- c:\program files\SpywareBlaster
2009-02-12 10:28 <DIR> --d----- c:\program files\Lavasoft
2009-02-12 03:57 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-02-12 03:57 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-02-11 15:55 <DIR> --d----- c:\docume~1\dee\applic~1\Pirateville
2009-02-11 14:57 <DIR> --d----- c:\windows\SxsCaPendDel
2009-02-11 13:02 <DIR> --d----- c:\windows\Apiary Quest
2009-02-11 13:02 <DIR> --d----- c:\program files\Apiary Quest
2009-02-11 10:00 <DIR> --d----- c:\program files\Bonjour
2009-02-10 20:09 <DIR> --d----- c:\docume~1\dee\applic~1\Realv1005
2009-02-09 04:20 23,040 a------- c:\windows\system32\drivers\SET37C.tmp
2009-02-09 04:20 23,040 a------- c:\windows\system32\drivers\SET37A.tmp
2009-02-08 21:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ParetoLogic
2009-02-08 21:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DriverCure
2009-02-08 21:43 199,864 a------- c:\windows\system32\gdtwain2.tlb
2009-02-08 21:43 <DIR> --d----- c:\program files\GdTwain ActiveX
2009-02-08 21:34 2,134,664 a------- c:\windows\system32\gdimgplug.dll
2009-02-08 21:34 1,296,520 a------- c:\windows\system32\gdpdfplug.dll
2009-02-08 21:34 949,384 a------- c:\windows\system32\gdocrplug.tesseract.dll
2009-02-08 21:34 130,184 a------- c:\windows\system32\GDTWAIN.DLL
2009-02-08 21:34 1,237,640 a------- c:\windows\system32\gdtwain2s.ocx
2009-02-08 21:34 1,237,640 a------- c:\windows\system32\gdtwain2.ocx
2009-02-08 21:34 74,240 a------- c:\windows\system32\zlibwapi.dll
2009-02-08 21:34 1,760 a------- c:\windows\system32\objsafe.tlb
2009-02-08 21:34 1,724,416 a------- c:\windows\system32\GDIPLUS.DLL
2009-02-08 21:34 152,848 a------- c:\windows\system32\comdlg32.ocx
2009-02-08 18:53 <DIR> --d----- c:\docume~1\dee\applic~1\Jetsetter
2009-02-08 18:02 <DIR> --d----- c:\docume~1\dee\applic~1\Anabel
2009-02-08 16:47 <DIR> --d----- c:\windows\Speeditup Free
2009-02-08 16:22 <DIR> --d----- c:\program files\Jetsetter
2009-02-07 23:09 <DIR> --d----- c:\docume~1\dee\applic~1\Skunk Studios
2009-02-05 03:02 <DIR> --d----- c:\docume~1\dee\applic~1\SpinTop
2009-02-04 16:49 <DIR> --d----- c:\documents and settings\dee\Contacts
2009-02-04 16:47 <DIR> --d----- c:\program files\MSN Messenger
2009-02-04 10:05 <DIR> --d----- c:\windows\oceanix
2009-02-04 10:05 <DIR> --d----- c:\program files\oceanix
2009-02-04 09:54 <DIR> --d----- c:\docume~1\dee\applic~1\ViquaSoft
2009-02-04 02:10 <DIR> --d----- c:\docume~1\dee\applic~1\Gold Casual Games
2009-02-04 02:10 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Gold Casual Games
2009-02-03 09:47 3,883,008 a------- c:\windows\system32\Tropix2.scr
2009-02-03 09:47 258,352 a------- c:\windows\system32\unicows.dll
2009-02-02 21:51 <DIR> --d----- c:\docume~1\dee\applic~1\blg
2009-02-02 21:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\blg
2009-02-01 04:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\HoverBee Studios
2009-01-31 21:06 <DIR> --d----- c:\docume~1\dee\applic~1\Boomzap
2009-01-31 21:06 <DIR> --d----- c:\program files\Jewels of Cleopatra
2009-01-31 16:20 <DIR> --d----- c:\windows\system32\XPSViewer
2009-01-31 16:19 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-01-31 16:19 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-01-31 16:19 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-01-31 16:19 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-31 16:19 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-01-31 16:19 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-01-31 16:19 117,760 -------- c:\windows\system32\prntvpt.dll
2009-01-31 16:19 <DIR> --d----- C:\923d7d9de11b9cd7a9ace1
2009-01-31 15:58 <DIR> --ds---- c:\documents and settings\dee\UserData
2009-01-30 13:34 69,723 a------- c:\windows\system32\SynTPFcs.dll
2009-01-30 13:34 191,872 a------- c:\windows\system32\drivers\SynTP.sys
2009-01-30 13:34 114,688 a------- c:\windows\system32\SynCtrl.dll
2009-01-30 13:34 94,299 a------- c:\windows\system32\SynTPAPI.dll
2009-01-30 13:34 82,014 a------- c:\windows\system32\SynCOM.dll
2009-01-30 13:34 81,920 a------- c:\windows\system32\SynTPCo2.dll
2009-01-30 13:34 <DIR> --d----- c:\program files\Synaptics
2009-01-29 12:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NeoEdge Networks
2009-01-29 11:19 <DIR> --d----- c:\program files\iWin.com
2009-01-29 11:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\iWin Games
2009-01-28 18:49 <DIR> --d----- c:\program files\ABBYY FineReader 6.0
2009-01-28 18:49 <DIR> --d----- c:\program files\ABBYY FineReader 5.0 Sprint
2009-01-28 18:46 <DIR> --d----- c:\program files\Lexmark X6100 Series
2009-01-28 18:46 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2009-01-28 18:46 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-01-28 18:46 87,040 ac------ c:\windows\system32\dllcache\wiafbdrv.dll
2009-01-28 18:46 87,040 a------- c:\windows\system32\wiafbdrv.dll
2009-01-28 18:31 1,585 a------- c:\windows\LEXSTAT.INI
2009-01-28 18:27 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
2009-01-28 18:27 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-01-28 11:54 <DIR> --d----- c:\documents and settings\dee\WINDOWS
2009-01-27 11:47 <DIR> --d----- c:\docume~1\dee\applic~1\Elladive3
2009-01-27 08:00 <DIR> --d----- c:\program files\Unicorn Castle
2009-01-27 01:41 <DIR> --d----- c:\docume~1\dee\applic~1\Island
2009-01-27 01:40 <DIR> --d----- c:\program files\Rescue at Rajini Island
2009-01-26 13:27 208,744 a------- c:\windows\system32\muweb.dll
2009-01-26 13:27 268,648 a------- c:\windows\system32\mucltui.dll
2009-01-26 13:27 27,496 a------- c:\windows\system32\mucltui.dll.mui
2009-01-26 13:25 <DIR> --d----- c:\program files\Conduit
2009-01-26 13:25 <DIR> --d----- c:\program files\RadarSync
2009-01-26 12:32 427,864 a------- c:\windows\system32\XceedZip.dll
2009-01-26 12:32 1,686,016 a------- c:\windows\system32\clinetsuitex6.ocx
2009-01-26 12:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Drivers HeadQuarters
2009-01-26 12:19 <DIR> --d----- c:\program files\PC Drivers HeadQuarters
2009-01-26 12:11 <DIR> --d----- c:\docume~1\dee\applic~1\DriverCure
2009-01-26 12:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Downloaded Installations
2009-01-25 18:58 1,499,136 -c------ c:\windows\system32\dllcache\shdocvw.dll
2009-01-25 11:56 61,224 a------- c:\documents and settings\dee\GoToAssistDownloadHelper.exe
2009-01-25 07:02 <DIR> --d----- c:\docume~1\dee\applic~1\RobinsonCrusoe
2009-01-25 01:03 <DIR> --d----- c:\program files\The Legend of Tirnanog
2009-01-24 20:05 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ScreenSeven
2009-01-24 20:05 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intenium
2009-01-24 20:00 <DIR> --d----- c:\docume~1\dee\applic~1\GameInvest
2009-01-24 20:00 4,096 a------- c:\windows\d3dx.dat
2009-01-23 19:33 <DIR> --d----- c:\docume~1\alluse~1\applic~1\LogMeIn
2009-01-23 19:31 28,984 a------- c:\windows\system32\LMIport.dll
2009-01-23 19:31 83,288 a------- c:\windows\system32\LMIRfsClientNP.dll
2009-01-23 19:31 47,640 a------- c:\windows\system32\drivers\LMIRfsDriver.sys
2009-01-23 19:31 87,352 a------- c:\windows\system32\LMIinit.dll
2009-01-23 19:31 1,024 a------- C:\.rnd
2009-01-23 19:31 <DIR> --d----- c:\program files\LogMeIn
2009-01-23 04:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Nick Chase A Detective Story
2009-01-22 22:09 <DIR> --d----- c:\docume~1\dee\applic~1\cerasus.media
2009-01-22 19:40 <DIR> --d----- c:\documents and settings\dee\Saved Games
2009-01-22 18:58 <DIR> --d----- c:\program files\iPod
2009-01-22 18:58 <DIR> --d----- c:\program files\iTunes
2009-01-22 18:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-22 12:16 <DIR> --d----- c:\docume~1\dee\applic~1\SpinTop Games
2009-01-22 06:24 2,414,360 a------- c:\windows\system32\d3dx9_31.dll
2009-01-22 06:21 <DIR> --d-h--- c:\windows\msdownld.tmp
2009-01-22 06:21 <DIR> --d----- c:\windows\Logs
2009-01-22 04:41 <DIR> --d----- c:\program files\ATI Technologies
2009-01-22 04:25 0 a------- c:\windows\system32\null
2009-01-22 04:20 <DIR> --d----- c:\program files\Dell Support Center
2009-01-22 04:20 <DIR> --d----- c:\program files\common files\supportsoft
2009-01-21 21:48 0 a------- c:\windows\ativpsrm.bin
2009-01-21 21:33 <DIR> --d----- c:\docume~1\dee\applic~1\Ancient Quest of Saqqarah__cminion
2009-01-21 21:33 <DIR> --d----- c:\docume~1\dee\applic~1\Saqqarah
2009-01-21 20:25 <DIR> --d----- c:\docume~1\dee\applic~1\JewelMatch2
2009-01-21 18:51 664 a------- c:\windows\system32\d3d9caps.dat
2009-01-21 17:39 552 a------- c:\windows\system32\d3d8caps.dat
2009-01-21 14:13 <DIR> --d----- c:\windows\Super Collapse Puzzle Gallery 4
2009-01-21 14:13 <DIR> --d----- c:\program files\Super Collapse Puzzle Gallery 4
2009-01-21 13:28 <DIR> --d----- c:\docume~1\dee\applic~1\Symantec
2009-01-21 13:18 <DIR> --d----- c:\program files\Symantec
2009-01-21 13:16 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-01-21 13:16 15,464 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-01-21 13:16 128,104 a------- c:\windows\system32\drivers\WimFltr.sys
2009-01-21 13:16 15,088 a------- c:\windows\system32\drivers\vproeventmonitor.sys
2009-01-21 13:16 38,112 a------- c:\windows\system32\drivers\v2imount.sys
2009-01-21 13:16 136,416 a------- c:\windows\system32\drivers\symsnap.sys
2009-01-21 13:15 <DIR> --d----- c:\program files\common files\Symantec Shared
2009-01-21 13:14 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Symantec
2009-01-21 13:14 <DIR> --d----- c:\program files\Norton Ghost
2009-01-21 12:57 32,592 a------- c:\windows\system32\msonpmon.dll
2009-01-21 12:09 <DIR> --d----- c:\program files\Val Gor
2009-01-21 12:08 <DIR> --d----- c:\docume~1\dee\applic~1\Meridian93
2009-01-21 12:05 <DIR> --d----- c:\docume~1\dee\applic~1\Cat's Eye Games
2009-01-21 12:03 <DIR> --d----- c:\program files\Games
2009-01-21 11:11 <DIR> --d----- c:\program files\Diamond Drop 2
2009-01-21 10:48 <DIR> --d----- c:\docume~1\dee\applic~1\PendulumQuest
2009-01-21 10:37 <DIR> --d----- c:\program files\Mystery Case Files Huntsville
2009-01-21 10:07 <DIR> --d----- c:\program files\GameTop.com
2009-01-21 09:23 <DIR> --d----- c:\program files\Hawaiian Explorer Lost Island
2009-01-21 09:18 <DIR> --d----- c:\program files\Tropicabana
2009-01-21 09:02 <DIR> --d----- c:\program files\Enigma 7
2009-01-21 08:40 <DIR> --d----- c:\program files\Hoteis Jewels
2009-01-21 08:39 <DIR> --d----- c:\program files\ReflexiveArcade
2009-01-21 07:30 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NeptunesAdve
2009-01-21 07:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SpinTop Games
2009-01-21 07:22 <DIR> --d----- c:\program files\Mystery P.I. - The Vegas Heist
2009-01-21 07:07 <DIR> --d----- c:\docume~1\dee\applic~1\JoyBits
2009-01-21 07:02 <DIR> --d----- c:\docume~1\dee\applic~1\Big Fish Games
2009-01-21 06:58 <DIR> --d----- c:\docume~1\dee\applic~1\Abra Academy2
2009-01-21 06:50 <DIR> --d----- c:\program files\Forgotten Riddles
2009-01-21 02:48 <DIR> --d----- c:\docume~1\dee\applic~1\iWin
2009-01-20 21:54 <DIR> --d----- c:\program files\Siber Systems
2009-01-20 21:29 <DIR> --d----- c:\docume~1\dee\applic~1\Digital Support
2009-01-20 21:29 <DIR> --d----- c:\program files\Digital Support
2009-01-20 21:27 <DIR> --d----- c:\program files\VS Revo Group

==================== Find3M ====================

2009-02-11 10:19 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 10:19 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-25 06:16 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys
2009-01-09 12:03 213,640 a------- c:\windows\system32\drivers\mfehidk.sys
2008-12-25 19:06 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-12 11:18 87,336 a------- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a------- c:\windows\system32\dnssd.dll
2008-11-29 09:28 77,423 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-10-17 13:29 1,300,048 a------- c:\docume~1\alluse~1\applic~1\pswi_preloaded.exe
2008-07-07 14:35 774,144 a------- c:\program files\RngInterstitial.dll
2002-07-01 09:13 224 a--sh--- c:\docume~1\dee\applic~1\maildriver32.dat
2008-10-17 13:31 8 ---shr-- c:\windows\system32\614AE4A6D2.sys

============= FINISH: 15:11:00.54 ===============

 

Hi Dee
How are things after running MBAM?

Geri

 

Geri,
It's looking good, ran new scan today, will post results, infected objects down to 2 from a bunch in last scan. Haven't run a Kaspersky, that necessary?
Malwarebytes' Anti-Malware 1.34
Database version: 1794
Windows 5.1.2600 Service Pack 3

2/22/2009 3:52:30 PM
mbam-log-2009-02-22 (15-52-30).txt

Scan type: Full Scan (C:\|)
Objects scanned: 217190
Time elapsed: 1 hour(s), 47 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\MSN Messenger\riched20.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP168\A0040545.DLL (Adware.FunWeb) -> Quarantined and deleted successfully.

 

Hi

Would be a good idea. post the log here.

Thanks
Geri

 

Geri,
Before I post the Kaspersky, could you take a peek at Slow Computer ? Virus. No one has checked my logs and I don't think it's a virus problem, just want to make sure.

KASPERSKY ONLINE SCANNER 7 REPORT
Monday, February 23, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, February 23, 2009 12:19:05
Records in database: 1834041
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
C:\
D:\
Scan statistics
Files scanned 118583
Threat name 3
Infected objects 5
Suspicious objects 0
Duration of the scan 02:25:39

File name Threat name Threats count
C:\Documents and Settings\dee\Desktop\Game Installer3\Rescue at Rajini Island.exe Infected: Backdoor.Win32.Rbot.aaqo 1
C:\Documents and Settings\dee\Desktop\game installers 1\SD_Neptunes_Secret\Neptunes Secret\NeptunesSecret.exe Infected: Trojan-Downloader.Win32.Agent.biba 1
C:\Documents and Settings\dee\Desktop\game installers 1\SD_Neptunes_Secret\Neptunes Secret\NeptunesSecret.exe.BAK Infected: Trojan-Downloader.Win32.Agent.biba 1
C:\Documents and Settings\dee\Desktop\WinRAR.exe Infected: Backdoor.Win32.VB.gxt 1
C:\Program Files\Rescue at Rajini Island\rqqlszs.exe Infected: Backdoor.Win32.Rbot.aaqo 1
The selected area was scanned.

 

Hi Dee
I'll try to get to your other thread as soon as I can.

These games need to be deleted.
Rescue at Rajini Island
SD_Neptunes_Secret

Then these files.
C:\Documents and Settings\dee\Desktop\Game Installer3\Rescue at Rajini Island.exe
C:\Documents and Settings\dee\Desktop\game installers 1\SD_Neptunes_Secret\Neptunes Secret\NeptunesSecret.exe
C:\Documents and Settings\dee\Desktop\game installers 1\SD_Neptunes_Secret\Neptunes Secret\NeptunesSecret.exe.BAK
C:\Program Files\Rescue at Rajini Island\rqqlszs.exe

What web site did you get WinRAR from? It is infected and needs to be deleted.
C:\Documents and Settings\dee\Desktop\WinRAR.exe

Geri

 

Thanks Geri,
I deleted the files and double checked that they were indeed deleted. I had 2 Winrars installed. the problem file came from Zango. I don't usually download from them, but for some reason I did this time.
About the other thread, I can't get Kaspersky to scan on it, will try again tomorrow so it's not ready for you. Trying to have every thing ready.

Dee

 

Hi Dee
OK good, also stay away from Zango.

Run ATF Cleaner and then do a scan with your Anti Virus program and let me know if it finds anything.

Geri

 

Geri,
I ran AVG but I could not copy and paste the report, it would not allow me to highlight to copy, i ran Malwarebytes instead,the reports are very different, Avg found 6 viruses.
Malwarebytes' Anti-Malware 1.34
Database version: 1798
Windows 5.1.2600 Service Pack 3

2/24/2009 9:13:44 AM
mbam-log-2009-02-24 (09-13-43).txt

Scan type: Full Scan (C:\|)
Objects scanned: 218263
Time elapsed: 1 hour(s), 51 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

Hi Dee
Could you write down the file paths from the AV scan and post it here?

Thanks
Geri

 

Geri,
I pieced this together, I hope it helps. Did get something to highlight.

INFECTIONS:

"C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP133\A0030891.exe "; "Virus found Win32/PEPatch "; "Moved to Virus Vault "
"C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP134\A0031041.exe "; "Virus found Win32/PEPatch "; "Moved to Virus Vault "
"C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP183\A0045293.exe "; "Virus found Win32/PEPatch "; "Moved to Virus Vault "
"C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP183\A0045294.exe "; "Trojan horse Generic12.YJE "; "Moved to Virus Vault "
"C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP183\A0045294.exe:\explore.exe "; "Trojan horse Generic12.YJE "; "Moved to Virus Vault "
"C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP86\A0019395.exe "; "Virus found Win32/PEPatch "; "Moved to Virus Vault "

SPYWARE

"C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP85\A0019145.rbf "; "Potentially harmful program WinFixer.AVK "; "Moved to Virus Vault "
"C:\System Volume Information\_restore{00842C35-3F7E-4288-AF2D-6961E91999D9}\RP86\A0019276.rbf "; "Potentially harmful program Fake_AntiSpyware.ABP "; "Moved to Virus Vault "

 

Hi Dee

OK please do this.

We need to turn off and on system restore. There are infections in it and by using system restore you would reinfect yourself.

You must be logged in as an Administrator to do this. If you are not logged in as an Administrator, the System Restore tab will not be displayed.
Turning off System Restore will clear out all previous restore points.

To turn off Windows XP System Restore:
NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:
1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives. "
5. Click Apply, and then click OK
6. Make a new restore point.
7. Click Start, All Programs, Accessories, System Tools, System Restore.
Choose Create a restore point and clicked Next, Under “Type a description for your restore point…”put a name in the box,. Click Create. In the next window click Close.

Now run another scan and see what it comes up with.

Geri

 

Geri,
Hope I did everything right and that this is the right scan. AVG Antivirus

Scan "Scan whole computer" was finished.
No infection was found during this scan
Folders selected for scanning:; "Scan whole computer "
Scan started:; "Wednesday, February 25, 2009, 11:59:23 PM "
Scan finished:; "Thursday, February 26, 2009, 1:23:53 AM (1 hour(s) 24 minute(s) 30 second(s)) "
Total object scanned:; "456257 "
User who launched the scan:; "dee "

Warnings
File; "Infection "; "Result "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite; "Found Tracking cookie.Revsci "; "Healed "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\adopt.euroclick.com.17044b51; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\adopt.euroclick.com.6d7740f7; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\adopt.euroclick.com.891542da; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\adopt.euroclick.com.8b1bd7bc; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\adopt.euroclick.com.fb764ef7; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\adopt.euroclick.com.ffe11db7; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\casalemedia.com.156cbc67; "Found Tracking cookie.Casalemedia "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\casalemedia.com.1773afc; "Found Tracking cookie.Casalemedia "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\casalemedia.com.3a28db8d; "Found Tracking cookie.Casalemedia "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\casalemedia.com.650648e8; "Found Tracking cookie.Casalemedia "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\casalemedia.com.80ad4799; "Found Tracking cookie.Casalemedia "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\casalemedia.com.987e6b46; "Found Tracking cookie.Casalemedia "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\revsci.net.2df99d79; "Found Tracking cookie.Revsci "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\revsci.net.44927ec; "Found Tracking cookie.Revsci "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\revsci.net.55564293; "Found Tracking cookie.Revsci "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\revsci.net.e9dbeb91; "Found Tracking cookie.Revsci "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\searchportal.information.com.3a8d7204; "Found Tracking cookie.Information "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\searchportal.information.com.44e78b2; "Found Tracking cookie.Information "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\searchportal.information.com.99ee829d; "Found Tracking cookie.Information "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Application Data\Mozilla\Firefox\Profiles\1fpt3l0j.default\cookies.sqlite:\statcounter.com.94d5ceb; "Found Tracking cookie.Statcounter "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@adopt.euroclick[1].txt; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@adopt.euroclick[1].txt:\adopt.euroclick.com.891542da; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@adopt.euroclick[1].txt:\adopt.euroclick.com.fb764ef7; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@adopt.euroclick[1].txt:\adopt.euroclick.com.ffe11db7; "Found Tracking cookie.Euroclick "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@bs.serving-sys[1].txt; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@bs.serving-sys[1].txt:\bs.serving-sys.com.5bf1f00f; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@realmedia[1].txt; "Found Tracking cookie.Realmedia "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@realmedia[1].txt:\realmedia.com.68087763; "Found Tracking cookie.Realmedia "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@serving-sys[2].txt; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@serving-sys[2].txt:\serving-sys.com.255d6f2f; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@serving-sys[2].txt:\serving-sys.com.400f83f; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@serving-sys[2].txt:\serving-sys.com.4b416ef8; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@serving-sys[2].txt:\serving-sys.com.606c3d3b; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@serving-sys[2].txt:\serving-sys.com.6a1cf9e8; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@serving-sys[2].txt:\serving-sys.com.c9034af6; "Found Tracking cookie.Serving-sys "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@tacoda[2].txt; "Found Tracking cookie.Tacoda "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@tacoda[2].txt:\tacoda.net.27341d57; "Found Tracking cookie.Tacoda "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@tacoda[2].txt:\tacoda.net.4366831a; "Found Tracking cookie.Tacoda "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@tacoda[2].txt:\tacoda.net.5935e89; "Found Tracking cookie.Tacoda "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@tacoda[2].txt:\tacoda.net.c4fe2ebb; "Found Tracking cookie.Tacoda "; "Moved to Virus Vault "
C:\Documents and Settings\dee\Cookies\dee@tacoda[2].txt:\tacoda.net.ed9c50d1; "Found Tracking cookie.Tacoda "; "Moved to Virus Vault "

Information
File; "Infection "; "Result "
C:\Program Files\Hoteis Jewels\hge.dll; "Multiple runtime compression aspack,upx ";" "

 

Hi Dee
OK looks good,
Not sure why AVG is flagging this?
C:\Program Files\Hoteis Jewels\hge.dll

I can seem to find anything bad on it.

Open FireFox
Click on Tools
Click on Options
Click on Privacy
On the Cookies section, uncheck "accept third-party cookies "
Click OK.

Now Click on Start > Control Panel > Internet Options
Click on the Privacy Tab.
If it is set to "Accept All Cookies ", move it up to the next line...(Low)
Click Apply Then OK.

How are things running?

Geri

 

Geri,

The computer is running fine,no problems. I removed Hotel Jewels, if it's being flagged I want it gone.
Thank you so much for your patience and help.

Dee

 

Hi
You are welcome.

I'll mark this one resolved.
Surf Safely.
Geri