Pop help

Question

I am running Windows XP and have lots of popups. Tried running Search & Destroy but still have popups. Here is the log from HijackThis. Any help greatly appreciated

Logfile of HijackThis v1.99.1
Scan saved at 7:58:45 AM, on 4/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\FolderShare\FolderShare.exe
C:\Program Files\AceLogix\StartupGuard\sg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ehs.edgemont.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WTLHelper Object - {6D33B121-5C4C-4450-9D1F-7B67085CC199} - C:\WINDOWS\system32\geeda.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\qyommijw.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKCU\..\Run: [FolderShare] "C:\Program Files\FolderShare\FolderShare.exe" /background
O4 - HKCU\..\Run: [Startup Guard] C:\Program Files\AceLogix\StartupGuard\sg.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/19a2712307574ab33614/netzip/RdxIE601.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax3313.cab
O20 - Winlogon Notify: geeda - C:\WINDOWS\system32\geeda.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Bugbatter · Answer

Welcome :)
You did not mention what type of pop-ups, so I'll guess based on what I see in your log.

Please download the latest version of
VundoFix.exe to your desktop. (If you have an earlier version, delete it and its old log here: C:\ vundofix.txt.)

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files,
click YES
Once you click yes, your desktop will go blank as it starts removing
Vundo.
When completed, it will prompt that it will shutdown your computer,
click OK.
Turn your computer back on.
Please post the contents of C:\vundofix.txt and a new
HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not
remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. ** If you get a warning about updating Java, do not do so until I can give you further instructions.

Bugbatter · Answer

Well... I think we 'hit the nail on the head' with that one. You may have broken a record with those Vundo files. We still have more work to do, though. Please print these instructions so you can refer to them easily, and follow the steps in order. * Double-click VundoFix.exe to run it again. Click Scan for Vundo button. * Once the scan is complete, Right Click inside the listbox (white box) and click add more files * Copy&Paste the 2 entries below into the top 2 boxes C:\WINDOWS\system32\qyommijw.dll C:\WINDOWS\system32\wjimmoyq.* * Click Add Files. Repeat until they are all added. Click Close Window * Click the Remove Vundo button. * You will receive a prompt asking if you want to remove the files, click YES * Once you click yes, your desktop will go blank as it starts removing Vundo. * When completed, it will prompt that it will shutdown your computer, click OK. * Turn your computer back on. ** If you get a warning in your VundoFix log about updating Java, do not do so until I can give you further instructions. Please launch HijackThis and place a checkmark next to these if they still exist: R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\qyommijw.dllO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/19a2712307574ab33614/netzip/RdxIE601.cabO20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) Close all windows except HijackThis and click 'Fix Checked'. Close hijackThis. Reboot into Safemode: Turn on the computer. Immediately begin tapping the F8 key. Use the arrow keys to highlight Safe Mode and press the Enter key. Configure to show all files/folders: Go to Start>Search and at the top select Tools>Folder Options Select the View tab Display the contents of system folders Show hidden files and folders Uncheck: Hide protected operating system files Click on Apply. Next go to the side of the Search box and select All files and folders. Go down to More advanced options. Be sure the first three boxes are selected: Search System folders Search Hidden Files and folders Search SubFolders Hopefully, this will be gone, but please check to be sure. If it's still there delete the file: C:\WINDOWS\system32\ qyommijw.dll --file Rehide protected files: Start>Search and at the top select Tools>Folder Options Select the View tab Display the contents of system folders Show hidden files and folders Check: Hide protected operating system files Click on Apply. REBOOT normally. Let's do a follow-up scan here: Download Dr.Web CureIt to the desktop: From here: ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe Or from here: http://www.freedrweb.com/cureit/ * Doubleclick the drweb-cureit.exe file and Allow to run the express scan * This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. * Once the short scan has finished, Click Options> Change settings * Choose the ' Scan'-tab, remove the mark at 'Heuristic analysis'. * Back at the main window, mark the drives that you want to scan. * Select all drives. A red dot shows which drives have been chosen. * Click the green arrow at the right, and the scan will start. * Click 'Yes to all' if it asks if you want to cure/move the file. * When the scan has finished, look if you can click next icon next to the files found: (It looks like a checkmark with pages) * If so, click it and then click the next icon right below and select ' Move incurable' This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples) * After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list * Save the report to your desktop. The report will be called DrWeb.csv * Close Dr.Web Cureit. * Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot. * After reboot, please post the contents of the log from Dr.Web you saved previously, the contents of C:\vundofix.txt and a new HiJackThis log. Edited to fix HTML. Message Edited by Bugbatter on 04-28-2007 05:02 PM

Melpik · Answer

Here is the new Hijack this log:   Logfile of HijackThis v1.99.1 Scan saved at 4:11:54 PM, on 4/28/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\FolderShare\FolderShare.exe C:\Program Files\AceLogix\StartupGuard\sg.exe C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ehs.edgemont.org/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost; R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\qyommijw.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKCU\..\Run: [FolderShare] 'C:\Program Files\FolderShare\FolderShare.exe' /background O4 - HKCU\..\Run: [Startup Guard] C:\Program Files\AceLogix\StartupGuard\sg.exe O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1esources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/19a2712307574ab33614/netzip/RdxIE601.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax3313.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe     Here is the Vundofix log:   VundoFix V6.3.20 Checking Java version... Java version is 1.5.0.11 Scan started at 2:34:58 PM 4/28/2007 Listing files found while scanning.... C:\WINDOWS\SYSTEM32\adeeg.bak1 C:\WINDOWS\system32\adeeg.bak2 C:\WINDOWS\system32\adeeg.ini C:\WINDOWS\system32\adeeg.ini2 C:\WINDOWS\system32\adeeg.tmp C:\WINDOWS\SYSTEM32\afkekmle.dll C:\WINDOWS\SYSTEM32\agimyduf.dll C:\WINDOWS\SYSTEM32\appvqpqo.dll C:\WINDOWS\SYSTEM32\beacgvyf.dll C:\WINDOWS\system32\bjqbvgjx.dll C:\WINDOWS\SYSTEM32\bjqpbmkk.dll C:\WINDOWS\SYSTEM32\bokbryuk.dll C:\WINDOWS\SYSTEM32\ccgupwuo.dll C:\WINDOWS\SYSTEM32\cclpcabr.dll C:\WINDOWS\SYSTEM32\coamcdco.dll C:\WINDOWS\SYSTEM32\ehuvchvo.ini C:\WINDOWS\SYSTEM32\eiopullg.dll C:\WINDOWS\SYSTEM32\esgexndb.dll C:\WINDOWS\SYSTEM32\etbiqepv.dll C:\WINDOWS\SYSTEM32\ethbqbie.dll C:\WINDOWS\SYSTEM32\fehnxdaf.dll C:\WINDOWS\system32\geeda.dll C:\WINDOWS\SYSTEM32\geqyutvn.dll C:\WINDOWS\system32\hxkvfwra.dll C:\WINDOWS\SYSTEM32\idviqrne.dll C:\WINDOWS\system32\iesghxbj.dll C:\WINDOWS\SYSTEM32\ilxavvcw.dll C:\WINDOWS\SYSTEM32\itiwqfbn.dll C:\WINDOWS\SYSTEM32\iutmowxf.dll C:\WINDOWS\SYSTEM32\jbfoygid.dll C:\WINDOWS\SYSTEM32\jbqoefof.dll C:\WINDOWS\SYSTEM32\jhxirdpn.dll C:\WINDOWS\system32\jsxasiev.dll C:\WINDOWS\SYSTEM32\jsxlhiir.dll C:\WINDOWS\SYSTEM32\klgcbyqi.dll C:\WINDOWS\SYSTEM32\kxwhmfim.dll C:\WINDOWS\SYSTEM32\ldggmflm.dll C:\WINDOWS\system32\ldnikdvp.dll C:\WINDOWS\SYSTEM32\lokqplax.dll C:\WINDOWS\SYSTEM32\luunnfcr.dll C:\WINDOWS\SYSTEM32
exaylps.exe C:\WINDOWS\SYSTEM32
oiumsss.dll C:\WINDOWS\SYSTEM32
wndbehp.dll C:\WINDOWS\SYSTEM32\omyqwema.dll C:\WINDOWS\SYSTEM32\oshjibix.dll C:\WINDOWS\SYSTEM32\otchrvvy.dll C:\WINDOWS\SYSTEM32\ovfmysno.dll C:\WINDOWS\SYSTEM32\ovhcvuhe.dll C:\WINDOWS\SYSTEM32\oxfaldrt.dll C:\WINDOWS\SYSTEM32\pgsxycmx.dll C:\WINDOWS\SYSTEM32\pillivgy.dll C:\WINDOWS\SYSTEM32\plhetqvu.dll C:\WINDOWS\SYSTEM32\pqthwsrb.dll C:\WINDOWS\SYSTEM32\qfkbondn.dll C:\WINDOWS\SYSTEM32\qlbumuip.dll C:\WINDOWS\SYSTEM32\scdianrj.dll C:\WINDOWS\SYSTEM32\sgfniheq.dll C:\WINDOWS\SYSTEM32\snbpxocw.dll C:\WINDOWS\SYSTEM32	emnapcn.dll C:\WINDOWS\SYSTEM32	yerweot.dll C:\WINDOWS\SYSTEM32\ufwjbols.dll C:\WINDOWS\SYSTEM32\ugjamdjp.dll C:\WINDOWS\SYSTEM32\upgdcyuu.dll C:\WINDOWS\SYSTEM32\uxqirbjj.dll C:\WINDOWS\SYSTEM32\vawocaoe.dll C:\WINDOWS\SYSTEM32\vdawgwdv.dll C:\WINDOWS\SYSTEM32\vhhyfwqb.dll C:\WINDOWS\SYSTEM32\vjlawsll.dll C:\WINDOWS\SYSTEM32\waalxdxn.dll C:\WINDOWS\SYSTEM32\wejfpxwf.dll C:\WINDOWS\SYSTEM32\xikfrurg.exe C:\WINDOWS\SYSTEM32\xponiuct.dll C:\WINDOWS\SYSTEM32\xpqjxhve.dll C:\WINDOWS\SYSTEM32\ytydxmuq.dll C:\WINDOWS\SYSTEM32\yyqfgqiu.dll Beginning removal...  Attempting to delete C:\WINDOWS\SYSTEM32\adeeg.bak1 C:\WINDOWS\SYSTEM32\adeeg.bak1 Has been deleted!  Attempting to delete C:\WINDOWS\system32\adeeg.bak2 C:\WINDOWS\system32\adeeg.bak2 Has been deleted!  Attempting to delete C:\WINDOWS\system32\adeeg.ini C:\WINDOWS\system32\adeeg.ini Has been deleted!  Attempting to delete C:\WINDOWS\system32\adeeg.ini2 C:\WINDOWS\system32\adeeg.ini2 Has been deleted!  Attempting to delete C:\WINDOWS\system32\adeeg.tmp C:\WINDOWS\system32\adeeg.tmp Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\afkekmle.dll C:\WINDOWS\SYSTEM32\afkekmle.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\agimyduf.dll C:\WINDOWS\SYSTEM32\agimyduf.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\appvqpqo.dll C:\WINDOWS\SYSTEM32\appvqpqo.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\beacgvyf.dll C:\WINDOWS\SYSTEM32\beacgvyf.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\bjqpbmkk.dll C:\WINDOWS\SYSTEM32\bjqpbmkk.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\bokbryuk.dll C:\WINDOWS\SYSTEM32\bokbryuk.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ccgupwuo.dll C:\WINDOWS\SYSTEM32\ccgupwuo.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\cclpcabr.dll C:\WINDOWS\SYSTEM32\cclpcabr.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\coamcdco.dll C:\WINDOWS\SYSTEM32\coamcdco.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ehuvchvo.ini C:\WINDOWS\SYSTEM32\ehuvchvo.ini Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\eiopullg.dll C:\WINDOWS\SYSTEM32\eiopullg.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\esgexndb.dll C:\WINDOWS\SYSTEM32\esgexndb.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\etbiqepv.dll C:\WINDOWS\SYSTEM32\etbiqepv.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ethbqbie.dll C:\WINDOWS\SYSTEM32\ethbqbie.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\fehnxdaf.dll C:\WINDOWS\SYSTEM32\fehnxdaf.dll Has been deleted!  Attempting to delete C:\WINDOWS\system32\geeda.dll C:\WINDOWS\system32\geeda.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\geqyutvn.dll C:\WINDOWS\SYSTEM32\geqyutvn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\idviqrne.dll C:\WINDOWS\SYSTEM32\idviqrne.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ilxavvcw.dll C:\WINDOWS\SYSTEM32\ilxavvcw.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\itiwqfbn.dll C:\WINDOWS\SYSTEM32\itiwqfbn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\iutmowxf.dll C:\WINDOWS\SYSTEM32\iutmowxf.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\jbfoygid.dll C:\WINDOWS\SYSTEM32\jbfoygid.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\jbqoefof.dll C:\WINDOWS\SYSTEM32\jbqoefof.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\jhxirdpn.dll C:\WINDOWS\SYSTEM32\jhxirdpn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\jsxlhiir.dll C:\WINDOWS\SYSTEM32\jsxlhiir.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\klgcbyqi.dll C:\WINDOWS\SYSTEM32\klgcbyqi.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\kxwhmfim.dll C:\WINDOWS\SYSTEM32\kxwhmfim.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ldggmflm.dll C:\WINDOWS\SYSTEM32\ldggmflm.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\lokqplax.dll C:\WINDOWS\SYSTEM32\lokqplax.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\luunnfcr.dll C:\WINDOWS\SYSTEM32\luunnfcr.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32
exaylps.exe C:\WINDOWS\SYSTEM32
exaylps.exe Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32
oiumsss.dll C:\WINDOWS\SYSTEM32
oiumsss.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32
wndbehp.dll C:\WINDOWS\SYSTEM32
wndbehp.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\omyqwema.dll C:\WINDOWS\SYSTEM32\omyqwema.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\oshjibix.dll C:\WINDOWS\SYSTEM32\oshjibix.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\otchrvvy.dll C:\WINDOWS\SYSTEM32\otchrvvy.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ovfmysno.dll C:\WINDOWS\SYSTEM32\ovfmysno.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ovhcvuhe.dll C:\WINDOWS\SYSTEM32\ovhcvuhe.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\oxfaldrt.dll C:\WINDOWS\SYSTEM32\oxfaldrt.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\pgsxycmx.dll C:\WINDOWS\SYSTEM32\pgsxycmx.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\pillivgy.dll C:\WINDOWS\SYSTEM32\pillivgy.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\plhetqvu.dll C:\WINDOWS\SYSTEM32\plhetqvu.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\pqthwsrb.dll C:\WINDOWS\SYSTEM32\pqthwsrb.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\qfkbondn.dll C:\WINDOWS\SYSTEM32\qfkbondn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\qlbumuip.dll C:\WINDOWS\SYSTEM32\qlbumuip.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\scdianrj.dll C:\WINDOWS\SYSTEM32\scdianrj.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\sgfniheq.dll C:\WINDOWS\SYSTEM32\sgfniheq.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\snbpxocw.dll C:\WINDOWS\SYSTEM32\snbpxocw.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32	emnapcn.dll C:\WINDOWS\SYSTEM32	emnapcn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32	yerweot.dll C:\WINDOWS\SYSTEM32	yerweot.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ufwjbols.dll C:\WINDOWS\SYSTEM32\ufwjbols.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ugjamdjp.dll C:\WINDOWS\SYSTEM32\ugjamdjp.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\upgdcyuu.dll C:\WINDOWS\SYSTEM32\upgdcyuu.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\uxqirbjj.dll C:\WINDOWS\SYSTEM32\uxqirbjj.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\vawocaoe.dll C:\WINDOWS\SYSTEM32\vawocaoe.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\vdawgwdv.dll C:\WINDOWS\SYSTEM32\vdawgwdv.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\vhhyfwqb.dll C:\WINDOWS\SYSTEM32\vhhyfwqb.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\vjlawsll.dll C:\WINDOWS\SYSTEM32\vjlawsll.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\waalxdxn.dll C:\WINDOWS\SYSTEM32\waalxdxn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\wejfpxwf.dll C:\WINDOWS\SYSTEM32\wejfpxwf.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\xikfrurg.exe C:\WINDOWS\SYSTEM32\xikfrurg.exe Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\xponiuct.dll C:\WINDOWS\SYSTEM32\xponiuct.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\xpqjxhve.dll C:\WINDOWS\SYSTEM32\xpqjxhve.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ytydxmuq.dll C:\WINDOWS\SYSTEM32\ytydxmuq.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\yyqfgqiu.dll C:\WINDOWS\SYSTEM32\yyqfgqiu.dll Has been deleted! Performing Repairs to the registry. Done!

Melpik · Answer

I tried to post the log from Dr. Web but it is too many characters but lots of infections.  Is there a way to post a file or can I send it to you off line?   Here is the Vundofix log:   VundoFix V6.3.20 Checking Java version... Java version is 1.5.0.11 Scan started at 2:34:58 PM 4/28/2007 Listing files found while scanning.... C:\WINDOWS\SYSTEM32\adeeg.bak1 C:\WINDOWS\system32\adeeg.bak2 C:\WINDOWS\system32\adeeg.ini C:\WINDOWS\system32\adeeg.ini2 C:\WINDOWS\system32\adeeg.tmp C:\WINDOWS\SYSTEM32\afkekmle.dll C:\WINDOWS\SYSTEM32\agimyduf.dll C:\WINDOWS\SYSTEM32\appvqpqo.dll C:\WINDOWS\SYSTEM32\beacgvyf.dll C:\WINDOWS\system32\bjqbvgjx.dll C:\WINDOWS\SYSTEM32\bjqpbmkk.dll C:\WINDOWS\SYSTEM32\bokbryuk.dll C:\WINDOWS\SYSTEM32\ccgupwuo.dll C:\WINDOWS\SYSTEM32\cclpcabr.dll C:\WINDOWS\SYSTEM32\coamcdco.dll C:\WINDOWS\SYSTEM32\ehuvchvo.ini C:\WINDOWS\SYSTEM32\eiopullg.dll C:\WINDOWS\SYSTEM32\esgexndb.dll C:\WINDOWS\SYSTEM32\etbiqepv.dll C:\WINDOWS\SYSTEM32\ethbqbie.dll C:\WINDOWS\SYSTEM32\fehnxdaf.dll C:\WINDOWS\system32\geeda.dll C:\WINDOWS\SYSTEM32\geqyutvn.dll C:\WINDOWS\system32\hxkvfwra.dll C:\WINDOWS\SYSTEM32\idviqrne.dll C:\WINDOWS\system32\iesghxbj.dll C:\WINDOWS\SYSTEM32\ilxavvcw.dll C:\WINDOWS\SYSTEM32\itiwqfbn.dll C:\WINDOWS\SYSTEM32\iutmowxf.dll C:\WINDOWS\SYSTEM32\jbfoygid.dll C:\WINDOWS\SYSTEM32\jbqoefof.dll C:\WINDOWS\SYSTEM32\jhxirdpn.dll C:\WINDOWS\system32\jsxasiev.dll C:\WINDOWS\SYSTEM32\jsxlhiir.dll C:\WINDOWS\SYSTEM32\klgcbyqi.dll C:\WINDOWS\SYSTEM32\kxwhmfim.dll C:\WINDOWS\SYSTEM32\ldggmflm.dll C:\WINDOWS\system32\ldnikdvp.dll C:\WINDOWS\SYSTEM32\lokqplax.dll C:\WINDOWS\SYSTEM32\luunnfcr.dll C:\WINDOWS\SYSTEM32
exaylps.exe C:\WINDOWS\SYSTEM32
oiumsss.dll C:\WINDOWS\SYSTEM32
wndbehp.dll C:\WINDOWS\SYSTEM32\omyqwema.dll C:\WINDOWS\SYSTEM32\oshjibix.dll C:\WINDOWS\SYSTEM32\otchrvvy.dll C:\WINDOWS\SYSTEM32\ovfmysno.dll C:\WINDOWS\SYSTEM32\ovhcvuhe.dll C:\WINDOWS\SYSTEM32\oxfaldrt.dll C:\WINDOWS\SYSTEM32\pgsxycmx.dll C:\WINDOWS\SYSTEM32\pillivgy.dll C:\WINDOWS\SYSTEM32\plhetqvu.dll C:\WINDOWS\SYSTEM32\pqthwsrb.dll C:\WINDOWS\SYSTEM32\qfkbondn.dll C:\WINDOWS\SYSTEM32\qlbumuip.dll C:\WINDOWS\SYSTEM32\scdianrj.dll C:\WINDOWS\SYSTEM32\sgfniheq.dll C:\WINDOWS\SYSTEM32\snbpxocw.dll C:\WINDOWS\SYSTEM32	emnapcn.dll C:\WINDOWS\SYSTEM32	yerweot.dll C:\WINDOWS\SYSTEM32\ufwjbols.dll C:\WINDOWS\SYSTEM32\ugjamdjp.dll C:\WINDOWS\SYSTEM32\upgdcyuu.dll C:\WINDOWS\SYSTEM32\uxqirbjj.dll C:\WINDOWS\SYSTEM32\vawocaoe.dll C:\WINDOWS\SYSTEM32\vdawgwdv.dll C:\WINDOWS\SYSTEM32\vhhyfwqb.dll C:\WINDOWS\SYSTEM32\vjlawsll.dll C:\WINDOWS\SYSTEM32\waalxdxn.dll C:\WINDOWS\SYSTEM32\wejfpxwf.dll C:\WINDOWS\SYSTEM32\xikfrurg.exe C:\WINDOWS\SYSTEM32\xponiuct.dll C:\WINDOWS\SYSTEM32\xpqjxhve.dll C:\WINDOWS\SYSTEM32\ytydxmuq.dll C:\WINDOWS\SYSTEM32\yyqfgqiu.dll Beginning removal...  Attempting to delete C:\WINDOWS\SYSTEM32\adeeg.bak1 C:\WINDOWS\SYSTEM32\adeeg.bak1 Has been deleted!  Attempting to delete C:\WINDOWS\system32\adeeg.bak2 C:\WINDOWS\system32\adeeg.bak2 Has been deleted!  Attempting to delete C:\WINDOWS\system32\adeeg.ini C:\WINDOWS\system32\adeeg.ini Has been deleted!  Attempting to delete C:\WINDOWS\system32\adeeg.ini2 C:\WINDOWS\system32\adeeg.ini2 Has been deleted!  Attempting to delete C:\WINDOWS\system32\adeeg.tmp C:\WINDOWS\system32\adeeg.tmp Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\afkekmle.dll C:\WINDOWS\SYSTEM32\afkekmle.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\agimyduf.dll C:\WINDOWS\SYSTEM32\agimyduf.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\appvqpqo.dll C:\WINDOWS\SYSTEM32\appvqpqo.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\beacgvyf.dll C:\WINDOWS\SYSTEM32\beacgvyf.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\bjqpbmkk.dll C:\WINDOWS\SYSTEM32\bjqpbmkk.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\bokbryuk.dll C:\WINDOWS\SYSTEM32\bokbryuk.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ccgupwuo.dll C:\WINDOWS\SYSTEM32\ccgupwuo.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\cclpcabr.dll C:\WINDOWS\SYSTEM32\cclpcabr.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\coamcdco.dll C:\WINDOWS\SYSTEM32\coamcdco.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ehuvchvo.ini C:\WINDOWS\SYSTEM32\ehuvchvo.ini Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\eiopullg.dll C:\WINDOWS\SYSTEM32\eiopullg.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\esgexndb.dll C:\WINDOWS\SYSTEM32\esgexndb.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\etbiqepv.dll C:\WINDOWS\SYSTEM32\etbiqepv.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ethbqbie.dll C:\WINDOWS\SYSTEM32\ethbqbie.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\fehnxdaf.dll C:\WINDOWS\SYSTEM32\fehnxdaf.dll Has been deleted!  Attempting to delete C:\WINDOWS\system32\geeda.dll C:\WINDOWS\system32\geeda.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\geqyutvn.dll C:\WINDOWS\SYSTEM32\geqyutvn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\idviqrne.dll C:\WINDOWS\SYSTEM32\idviqrne.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ilxavvcw.dll C:\WINDOWS\SYSTEM32\ilxavvcw.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\itiwqfbn.dll C:\WINDOWS\SYSTEM32\itiwqfbn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\iutmowxf.dll C:\WINDOWS\SYSTEM32\iutmowxf.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\jbfoygid.dll C:\WINDOWS\SYSTEM32\jbfoygid.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\jbqoefof.dll C:\WINDOWS\SYSTEM32\jbqoefof.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\jhxirdpn.dll C:\WINDOWS\SYSTEM32\jhxirdpn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\jsxlhiir.dll C:\WINDOWS\SYSTEM32\jsxlhiir.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\klgcbyqi.dll C:\WINDOWS\SYSTEM32\klgcbyqi.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\kxwhmfim.dll C:\WINDOWS\SYSTEM32\kxwhmfim.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ldggmflm.dll C:\WINDOWS\SYSTEM32\ldggmflm.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\lokqplax.dll C:\WINDOWS\SYSTEM32\lokqplax.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\luunnfcr.dll C:\WINDOWS\SYSTEM32\luunnfcr.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32
exaylps.exe C:\WINDOWS\SYSTEM32
exaylps.exe Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32
oiumsss.dll C:\WINDOWS\SYSTEM32
oiumsss.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32
wndbehp.dll C:\WINDOWS\SYSTEM32
wndbehp.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\omyqwema.dll C:\WINDOWS\SYSTEM32\omyqwema.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\oshjibix.dll C:\WINDOWS\SYSTEM32\oshjibix.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\otchrvvy.dll C:\WINDOWS\SYSTEM32\otchrvvy.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ovfmysno.dll C:\WINDOWS\SYSTEM32\ovfmysno.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ovhcvuhe.dll C:\WINDOWS\SYSTEM32\ovhcvuhe.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\oxfaldrt.dll C:\WINDOWS\SYSTEM32\oxfaldrt.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\pgsxycmx.dll C:\WINDOWS\SYSTEM32\pgsxycmx.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\pillivgy.dll C:\WINDOWS\SYSTEM32\pillivgy.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\plhetqvu.dll C:\WINDOWS\SYSTEM32\plhetqvu.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\pqthwsrb.dll C:\WINDOWS\SYSTEM32\pqthwsrb.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\qfkbondn.dll C:\WINDOWS\SYSTEM32\qfkbondn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\qlbumuip.dll C:\WINDOWS\SYSTEM32\qlbumuip.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\scdianrj.dll C:\WINDOWS\SYSTEM32\scdianrj.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\sgfniheq.dll C:\WINDOWS\SYSTEM32\sgfniheq.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\snbpxocw.dll C:\WINDOWS\SYSTEM32\snbpxocw.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32	emnapcn.dll C:\WINDOWS\SYSTEM32	emnapcn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32	yerweot.dll C:\WINDOWS\SYSTEM32	yerweot.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ufwjbols.dll C:\WINDOWS\SYSTEM32\ufwjbols.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ugjamdjp.dll C:\WINDOWS\SYSTEM32\ugjamdjp.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\upgdcyuu.dll C:\WINDOWS\SYSTEM32\upgdcyuu.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\uxqirbjj.dll C:\WINDOWS\SYSTEM32\uxqirbjj.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\vawocaoe.dll C:\WINDOWS\SYSTEM32\vawocaoe.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\vdawgwdv.dll C:\WINDOWS\SYSTEM32\vdawgwdv.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\vhhyfwqb.dll C:\WINDOWS\SYSTEM32\vhhyfwqb.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\vjlawsll.dll C:\WINDOWS\SYSTEM32\vjlawsll.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\waalxdxn.dll C:\WINDOWS\SYSTEM32\waalxdxn.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\wejfpxwf.dll C:\WINDOWS\SYSTEM32\wejfpxwf.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\xikfrurg.exe C:\WINDOWS\SYSTEM32\xikfrurg.exe Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\xponiuct.dll C:\WINDOWS\SYSTEM32\xponiuct.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\xpqjxhve.dll C:\WINDOWS\SYSTEM32\xpqjxhve.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\ytydxmuq.dll C:\WINDOWS\SYSTEM32\ytydxmuq.dll Has been deleted!  Attempting to delete C:\WINDOWS\SYSTEM32\yyqfgqiu.dll C:\WINDOWS\SYSTEM32\yyqfgqiu.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V6.3.20 Checking Java version... Java version is 1.5.0.11 Scan started at 5:42:06 PM 4/28/2007 Listing files found while scanning.... No infected files were found. Beginning removal...  Attempting to delete C:\WINDOWS\system32\qyommijw.dll C:\WINDOWS\system32\qyommijw.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V6.3.20 Checking Java version... Java version is 1.5.0.11 Scan started at 6:21:00 AM 4/29/2007 Listing files found while scanning.... No infected files were found.   Here is the Hijackthis log:   Logfile of HijackThis v1.99.1 Scan saved at 6:30:31 AM, on 4/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\FolderShare\FolderShare.exe C:\Program Files\AceLogix\StartupGuard\sg.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ehs.edgemont.org/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost; R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKCU\..\Run: [FolderShare] 'C:\Program Files\FolderShare\FolderShare.exe' /background O4 - HKCU\..\Run: [Startup Guard] C:\Program Files\AceLogix\StartupGuard\sg.exe O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1esources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax3313.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Bugbatter · Answer

You can post lengthy logs if you make several replies to yourself by just dividing the logs. Please post that log from Dr.Web and another fresh Hijakcthis log. Thanks.

Melpik · Answer

Here is part 6   ytydxmuq.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; yyqfgqiu.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; UWA6P_0001_N91M1807NetInstaller.exe;C:\WINDOWS\Downloaded Program Files;Trojan.DownLoader.10963;Deleted.; ajjgpfub.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;Moved.; cwmnebai.exe;C:\WINDOWS\SYSTEM32;Adware.TopSearch;Moved.; daqelksf.dll;C:\WINDOWS\SYSTEM32;Trojan.Virtumod;Deleted.; ddayy.dll;C:\WINDOWS\SYSTEM32;Trojan.DownLoader.6408;Deleted.; drcfmvbn.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;Moved.; jxektekq.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;Moved.; ntuttqhx.dll;C:\WINDOWS\SYSTEM32;Trojan.Virtumod;Deleted.; ookiajlf.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;Moved.; sluevyvj.dll;C:\WINDOWS\SYSTEM32;Trojan.Virtumod;Deleted.; uxpiqnmd.dll;C:\WINDOWS\SYSTEM32;Trojan.Virtumod;Deleted.; waxstynr.dll;C:\WINDOWS\SYSTEM32;Trojan.Virtumod;Deleted.; wonkgbvu.dll;C:\WINDOWS\SYSTEM32;Trojan.Virtumod;Deleted.; wwifwjof.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;Moved.; xsblainb.dll;C:\WINDOWS\SYSTEM32;Trojan.Virtumod;Deleted.; rebootnt.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp\~vis0000;Tool.Reboot;; GTDownAO_106.ocx;C:\Program Files\Common Files\AolCoach\en_en;Adware.Gdown;; A0092866.ocx;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1419;Adware.Gdown;; A0095655.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Adware.TopSearch;; A0096670.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Adware.TopSearch;; A0096671.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Adware.TopSearch;; A0096672.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Adware.TopSearch;; A0098795.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Adware.SearchColours;; A0098825.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Adware.SearchColours;; A0098878.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098879.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.DownLoader.6408;Deleted.; A0098880.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098881.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098882.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098883.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098884.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098885.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; nexaylps.exe.bad;C:\VundoFix Backups;Adware.SearchColours;; xikfrurg.exe.bad;C:\VundoFix Backups;Adware.SearchColours;; ajjgpfub.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;; cwmnebai.exe;C:\WINDOWS\SYSTEM32;Adware.TopSearch;; drcfmvbn.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;; jxektekq.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;; ookiajlf.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;; wwifwjof.exe;C:\WINDOWS\SYSTEM32;Adware.SearchColours;;

Melpik · Answer

Here is part 4   afkekmle.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; agimyduf.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; appvqpqo.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; beacgvyf.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; bjqpbmkk.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; bokbryuk.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; ccgupwuo.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; cclpcabr.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; coamcdco.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; eiopullg.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; esgexndb.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; etbiqepv.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; ethbqbie.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; fehnxdaf.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; geeda.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; geqyutvn.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; idviqrne.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; ilxavvcw.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; itiwqfbn.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; iutmowxf.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; jbfoygid.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; jbqoefof.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; jhxirdpn.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; jsxlhiir.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; klgcbyqi.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; kxwhmfim.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; ldggmflm.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; lokqplax.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; luunnfcr.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; nexaylps.exe.bad;C:\VundoFix Backups;Adware.SearchColours;Moved.; noiumsss.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; nwndbehp.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; omyqwema.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; oshjibix.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; otchrvvy.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; ovfmysno.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; ovhcvuhe.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; oxfaldrt.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; pgsxycmx.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; pillivgy.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; plhetqvu.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; pqthwsrb.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; qfkbondn.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; qlbumuip.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;

Melpik · Answer

Here is hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 12:10:56 PM, on 4/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\FolderShare\FolderShare.exe
C:\Program Files\AceLogix\StartupGuard\sg.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\WINDOWS\System32\MDM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ehs.edgemont.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKCU\..\Run: [FolderShare] "C:\Program Files\FolderShare\FolderShare.exe" /background
O4 - HKCU\..\Run: [Startup Guard] C:\Program Files\AceLogix\StartupGuard\sg.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax3313.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Melpik · Answer

Here is part 5   qyommijw.dll.bad;C:\VundoFix Backups;Trojan.Juan;Deleted.; scdianrj.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; sgfniheq.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; snbpxocw.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; temnapcn.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; tyerweot.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; ufwjbols.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; ugjamdjp.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; upgdcyuu.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; uxqirbjj.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; vawocaoe.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; vdawgwdv.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; vhhyfwqb.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; vjlawsll.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; waalxdxn.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; wejfpxwf.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; xikfrurg.exe.bad;C:\VundoFix Backups;Adware.SearchColours;Moved.; xponiuct.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.; xpqjxhve.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;

Bugbatter · Answer

Thanks :)

Let's do some general cleaning. Please download CCleaner. It is a good tool to keep and use for regular maintenance.

Download and scan each user profile with CCleaner:
http://www.ccleaner.com/downloadbuilds.asp
** Select to download the BASIC version.
1. Before first use, select Options > Advanced and UNCHECK
" Only delete files in Windows Temp folder older than 48 hours"
2. Then select the items you wish to clean up.
In the Windows Tab:
• Clean all entries in the "Internet Explorer" section.
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section.
• Clean all entries in the "Advanced" section.
• Clean any others that you choose.
In the Applications Tab:
• Clean all in the Firefox/Mozilla section if you use it.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.
3. Click the " Run Cleaner" button.
4. A pop up box will appear advising this process will permanently delete files from your system.
5. Click " OK" and it will scan and clean your system.
6. Click " exit" when done.
REBOOT.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says "Java Runtime Environment (JRE) 6u1 allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u1-windows-i586-p.exe to install the newest version.

Official JAVA Installation Instructions if needed.

Following that, please post a fresh Hijackthis log for final review, and let me know how things are running. Thanks.

Melpik · Answer

Here is the part 3   A0098799.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098800.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098801.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098802.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098803.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098804.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098805.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098806.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098807.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098808.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098809.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098810.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098811.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098812.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098813.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098814.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098815.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098816.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098817.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098818.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098819.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098820.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098821.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098822.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098823.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098824.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098825.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Adware.SearchColours;Moved.; A0098826.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098827.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098828.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098829.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098830.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098831.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098861.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Juan;Deleted.;

Melpik · Answer

Here is the first part of the Dr. Web log:   aakdcind.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; alcpdnlh.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; apfadcnc.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; bmeanjmd.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; bpofmaif.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; caejofod.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; cdichcnd.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; doleopmd.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; ebhgdcnc.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; foppbbmd.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; ibnacind.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; jehmjjnc.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; kcabnjmd.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; ldjffjha.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; lffeekdg.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; ljeapaif.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; lojjmljd.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Dialer.Maxd;Deleted.; uafuqdif.dll;C:\Documents and Settings\Allison KAndel\Local Settings\Temp;Trojan.Virtumod;Deleted.; rebootnt.exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temp\~vis0000;Tool.Reboot;Moved.; installdrivecleanerstart[1].exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temporary Internet Files\Content.IE5\14S3958D;Trojan.DownLoader.18101;Deleted.; WinAntiVirusPro2006FreeInstall[1].exe;C:\Documents and Settings\Allison KAndel\Local Settings\Temporary Internet Files\Content.IE5\2N1YP7Y2;Trojan.DownLoader.10963;Deleted.; alppeffg.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; bceokomd.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; ilhgodmh.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; jfleogpd.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; kkeolaic.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; lggbfbic.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; lnejjjjf.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; nbagijjf.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; nnfdcegd.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; nnfgogpd.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; olchgojf.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; opolhjjg.exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temp;Dialer.Maxd;Deleted.; WinAntiVirusPro2006FreeInstall[1].exe;C:\Documents and Settings\Elizabeth Kandel\Local Settings\Temporary Internet Files\Content.IE5\ZFHNV5W4;Trojan.DownLoader.10963;Deleted.; hardcore[1].htm\javascript.4;C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\Content.IE5\88GP0RY9\hardcore[1].htm;Trojan.DownLoader.2141;; hardcore[1].htm;C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\Content.IE5\88GP0RY9;Archive contains infected objects;Moved.; teen[1].htm\javascript.3;C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\Content.IE5\88GP0RY9	een[1].htm;Trojan.DownLoader.2141;; teen[1].htm;C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\Content.IE5\88GP0RY9;Archive contains infected objects;Moved.; CAIV4E7P;C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\Content.IE5\BWP5BOOC;Win32.HLLM.Graz;Incurable.Moved.; SysProtectScannerInstall[1].exe;C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\Content.IE5\BWP5BOOC;Trojan.DownLoader.9306;Deleted.;

Melpik · Answer

Here is part 2   WinAntiVirusPro2006FreeInstall[1].exe;C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\Content.IE5\HD32L1D3;Trojan.DownLoader.10346;Deleted.; UWA7P_0001_N91M0809NetInstaller.exe;C:\Documents and Settings\Paul Kandel\Local Settings\Temp\ICD1.tmp;Trojan.DownLoader.10963;Deleted.; GTDownAO_106.ocx;C:\Program Files\Common Files\AolCoach\en_en;Adware.Gdown;Moved.; A0092866.ocx;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1419;Adware.Gdown;Moved.; A0095651.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Trojan.Virtumod;Deleted.; A0095655.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Adware.TopSearch;Moved.; A0095658.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Trojan.Virtumod;Deleted.; A0096670.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Adware.TopSearch;Moved.; A0096671.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Adware.TopSearch;Moved.; A0096672.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1436;Adware.TopSearch;Moved.; A0098765.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098766.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098767.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098768.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098769.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098770.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098771.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098772.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098773.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098775.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098776.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098777.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098778.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098779.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098780.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098781.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098782.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098783.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098784.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098785.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098786.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098787.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098788.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098789.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098790.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098791.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098792.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098793.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098794.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098795.exe;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Adware.SearchColours;Moved.; A0098796.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098797.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.; A0098798.dll;C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1437;Trojan.Virtumod;Deleted.;

Melpik · Answer

I have not posted the DrWeb log in 6 parts as well as the hijack this log.   Sorry for the length but seems like lots of viruses detected.

Melpik · Answer

Here is the hikack log:   Logfile of HijackThis v1.99.1 Scan saved at 2:02:28 PM, on 4/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\FolderShare\FolderShare.exe C:\Program Files\AceLogix\StartupGuard\sg.exe C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ehs.edgemont.org/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost; R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe' O4 - HKCU\..\Run: [FolderShare] 'C:\Program Files\FolderShare\FolderShare.exe' /background O4 - HKCU\..\Run: [Startup Guard] C:\Program Files\AceLogix\StartupGuard\sg.exe O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1esources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin
pjpi160_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin
pjpi160_01.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax3313.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe     Do you have any idea what caused the infections and how to avoid it in the future?

Virus & Spyware

Pop help

Was this post helpful?