Need Help Please. Viruses and Infected Files on my Computer

Unknown

HI thanks in advanced for any help ya'll can give me. My computer is infected and i dont know how to clean it up. I scanned w/ spybot and ad-aware and cleaned some spyware, then i did online scan by kaspersky and it found 8 viruses and 51 infected files.Heres the log:

Sunday, December 31, 2006 2:09:46 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 31/12/2006
Kaspersky Anti-Virus database records: 255217


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics
Total number of scanned objects 94817
Number of viruses found 8
Number of infected objects 51 / 0
Number of suspicious objects 0
Duration of the scan process 01:21:18

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Musicmatch\Jukebox\mmjbaltlog.txt Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Musicmatch\Jukebox\mmjblog.txt Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Musicmatch\Jukebox\Portables.log Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Musicmatch\MIM\Database\Default.ldb Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Musicmatch\MIM\Database\Default.mdb Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012006123120070101\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Temp\JET645F.tmp Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped

C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped

C:\Program Files\BigFix\__Data\BigFix\__Local\Tmp\conf-900.dat Object is locked skipped

C:\Program Files\BigFix\__Data\BigFix\__Local\Tmp\ie7conflict.dat Object is locked skipped

C:\Program Files\BigFix\__Data\BigFix\__Local\Tmp\notes.dat Object is locked skipped

C:\Program Files\BigFix\__Data\BigFix\__Local\Tmp\partner-700.dat Object is locked skipped

C:\Program Files\BigFix\__Data\BigFix\__Local\Tmp\subscrip-2000.dat Object is locked skipped

C:\Program Files\BigFix\__Data\BigFix\__Local\Tmp\survey.dat Object is locked skipped

C:\Program Files\BigFix\__Data\BigFix\__Local\Tmp\updates-300.dat Object is locked skipped

C:\Program Files\BigFix\__Data\BigFix\__Local\Tmp\urgent-800.dat Object is locked skipped

C:\Program Files\Motive\AsstCommon\log\MotiveDirectory.log Object is locked skipped

C:\Program Files\SBC Self Support Tool\log\diag_svc.log Object is locked skipped

C:\Program Files\SBC Self Support Tool\log\mad.log Object is locked skipped

C:\Program Files\SBC Self Support Tool\log\mpbtn.log Object is locked skipped

C:\Program Files\SBC Self Support Tool\SmartBridge\AlertFilter.log Object is locked skipped

C:\Program Files\SBC Self Support Tool\SmartBridge\log\httpclient.log Object is locked skipped

C:\Program Files\SBC Self Support Tool\SmartBridge\SmartBridge.log Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP439\A0694967.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.EZula.cc skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP439\A0694967.exe/stream Infected: not-a-virus:AdWare.Win32.EZula.cc skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP439\A0694967.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP469\A0731110.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP469\A0731110.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP469\A0731110.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP471\A0732085.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP471\A0732085.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP471\A0732085.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733557.exe/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733557.exe/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733557.exe/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733557.exe/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733557.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733557.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733557.exe RarSFX: infected - 6 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733558.exe/data0009/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733558.exe/data0009/stream Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733558.exe/data0009 Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733558.exe NSIS: infected - 3 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733559.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.SideFind.a skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733559.exe/stream Infected: not-a-virus:AdWare.Win32.SideFind.a skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733559.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733560.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.EZula.cc skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733560.exe/stream Infected: not-a-virus:AdWare.Win32.EZula.cc skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733560.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733563.exe/data0009/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733563.exe/data0009/stream Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733563.exe/data0009 Infected: not-a-virus:AdWare.Win32.Softomate.e skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733563.exe NSIS: infected - 3 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733565.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.SideFind.a skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733565.exe/stream Infected: not-a-virus:AdWare.Win32.SideFind.a skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733565.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733566.exe/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733566.exe/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733566.exe/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733566.exe/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733566.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733566.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0733566.exe RarSFX: infected - 6 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0734540.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.EZula.cc skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0734540.exe/stream Infected: not-a-virus:AdWare.Win32.EZula.cc skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP473\A0734540.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP480\A0738813.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped

C:\System Volume Information\_restore{C5941BA0-7954-431B-BB37-2E1ABEED1085}\RP487\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{8D2D289B-5274-4077-83FC-E8B8CF134E26}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\mi2.exe/WISE0025.BIN/clientax.dll Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped

C:\WINDOWS\system32\mi2.exe/WISE0025.BIN Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped

C:\WINDOWS\system32\mi2.exe/WISE0028.BIN/stream/data0005 Infected: not-a-virus:AdWare.Win32.Softomate.aa skipped

C:\WINDOWS\system32\mi2.exe/WISE0028.BIN/stream Infected: not-a-virus:AdWare.Win32.Softomate.aa skipped

C:\WINDOWS\system32\mi2.exe/WISE0028.BIN Infected: not-a-virus:AdWare.Win32.Softomate.aa skipped

C:\WINDOWS\system32\mi2.exe WiseSFX: infected - 5 skipped

C:\WINDOWS\system32\mi2.exe WiseSFX Dropper: infected - 5 skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


And heres is the HiJAckThis Log just in case ya'll need it:

Logfile of HijackThis v1.99.1
Scan saved at 2:13:26 AM, on 12/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\PROGRA~1\Motive\ASSTCO~1\MOTIVE~1.EXE
C:\Program Files\SBC Self Support Tool\bin\mad.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Yahoo!\YOP\yop.exe
C:\Program Files\Yahoo!\Antivirus\CAV.EXE
C:\PROGRA~1\Yahoo!\browser\YBrowser.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn6\yt.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn6\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn6\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.gateway.com
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {20B845BF-450F-4C1E-AF60-3CC380CDE328} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPluginNOSSO.ocx
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/testgen/installers/TestGenXInstall.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1128806046140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128808091046
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4918/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

chiaz

# Please download the Killbox.
# Unzip it to the desktop but do NOT run it yet.
# Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.
# Once in Safe Mode, please run Killbox.
# Click "Delete on Reboot".
# Paste the following into the top "Full Path of File to Delete" box.

* C:\WINDOWS\system32\mi2.exe

# Click the red-and-white "Delete File".
# Click "Yes" at the Delete on Reboot prompt.
# Click "No" at the Pending Operations prompt.


1. Next click Start, point to Settings, and then click Control Panel.
2. Double-click System, and then click the Performance tab.
3. Click File System, and then click the Troubleshooting tab.
Click to select the Disable System Restore check box, click Apply, click to clear the Disable System Restore check box, click Apply, and then click OK.
4. Restart the computer when you are prompted to do so.
5. When the computer restarts, the data store is purged and the System Restore feature begins monitoring the system again.



Finally, run Panda ActiveScan.

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report.

Muzic713

ok i used the killbox thing and it deleted the mi2.exe file. i dont know if it matters but no prompt came up for Pending Operations so i couldnt click NO on that. I tried to do the system restore instructions but couldnt because i went to the control panel and double-clicked "System" but theres 7 Tabs named: General, Computer Name, Hardware, Advanced, Remote, Automatic Updates and System Restore but no tab named "Performance" so i did steps 1 and 2 but i couldnt get to do the 3,4, or 5. I did run the Panda Active Scan and heres the report:

1.Incident
2.Status
3.Location

1.Potentially unwanted tool:application/funweb
2.Not disinfected
3.hkey_classes_root\clsid\{00A6FAF6-072E-44cf-8957-5838F569A31D}

1.Potentially unwanted tool:application/mywebsearch
2.Not disinfected
3.hkey_classes_root\clsid\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

1.Adware:adware/savenow
2.Not disinfected
3.Windows Registry

1.Adware:adware/popupsearches
2.Not disinfected
3.Windows Registry

1.Potentially unwanted tool:application/zango
2.Not disinfected
3.HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{99410cde-6f16-42ce-9d49-3807f78f0287}

the log when i pasted it had a lot of blank spaces in between so i fixed it wouldnt look so bad. added numbers so that u could tell what they are. 1. is the Incident, 2. is Status and 3. is the Location

chiaz

Click the "System Restore" tab instead, and follow with the rest of the instructions to purge the system restore data store.

Next

• Click Start » Run » type: Notepad » OK
• Copy (Ctrl+C) and paste (Ctrl+V) the following text inside the quote box below (starting with REGEDIT4) to Notepad.
  

  REGEDIT4
  
  [-hkey_classes_root\clsid\{00A6FAF6-072E-44cf-8957-5838F569A31D}]
  [-hkey_classes_root\clsid\{07B18EA9-A523-4961-B6BB-170DE4475CCA}]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{99410cde-6f16-42ce-9d49-3807f78f0287}]
  

• Make sure there are no black spaces before REGEDIT4 and there should be one blank line at the end.
• Click File at the top and then choose Save As.
• Change Save As Type to All Files.
• Name it FixME.reg and save it on your desktop.
• Its icon should look like this :
• Double click FixME.reg. It will ask you if you want to merge it to the registry, click Yes.

Finally, rescan with Panda ActiveScan one more time and post the log in your next reply.

Muzic713

ok i went to the control panel and double-clicked system, clicked the system restore tab. on that tab it only has a box that says "turn off system restore" so i guessed thats the box im supposed to check. i then clicked apply, then it said "You have chosen to turn off System Restore. If you continue, all existing restore points will be deleted, and you will not be able to track or undo changes to your computer." I wasnt sure what to do so i clicked no. Am i supposed to click yes and delete all the restore points? Then i did the FixME.reg notepad thing and it mered it into the registry. Then i scanned w/ Panda ActiveScan and heres the log:

Incident
Status
Location

Potentially unwanted tool:application/mywebsearch
Not disinfected
hkey_classes_root\clsid\{9AFB8248-617F-460d-9366-D71CDEDA3179}

Adware:adware/savenow
Not disinfected
Windows Registry

Potentially unwanted tool:application/funweb
Not disinfected
hkey_classes_root\FunWebProducts.DataControl

Adware:adware/popupsearches
Not disinfected
Windows Registry

chiaz

You are supposed to click "yes" to clear the restore points.

# Click Start » Run » type: Notepad » OK
# Copy (Ctrl+C) and paste (Ctrl+V) the following text inside the quote box below (starting with REGEDIT4) to Notepad.

REGEDIT4

[-hkey_classes_root\clsid\{9AFB8248-617F-460d-9366-D71CDEDA3179}]
[-hkey_classes_root\FunWebProducts.DataControl]

# Make sure there are no black spaces before REGEDIT4 and there should be one blank line at the end.
# Click File at the top and then choose Save As.
# Change Save As Type to All Files.
# Name it FixME2.reg and save it on your desktop.

Double click FixME2.reg. It will ask you if you want to merge it to the registry, click Yes.



Your computer should be clean now. Are you having any problems with your computer?

Muzic713

ok i cleared the restored points and restarted. then i did the fixme2.reg and merged it. and then i ran panda another to see if i was finally clean and it found some stuff. heres the log:

Incident
Status
Location

Adware:adware/savenow
Not disinfected
Windows Registry

Potentially unwanted tool:application/funweb
Not disinfected
hkey_classes_root\FunWebProducts.DataControl.1

Adware:adware/popupsearches
Not disinfected
Windows Registry

and also after i merged those fixme.reg files can i delete them afterwards or do i have to leave them on the desktop

chiaz

You can delete those fixme files after they are successfully ran.

Looks like funweb is refusing to be removed. Please run full scans with Ad-Aware SE and Spybot-S&D as follows:
(If you already have Ad-Aware SE 1.06 and Spybot 1.4 installed, you can skip the installation steps. If you don't, please uninstall your old versions and install the new ones from the links below.)

Full Ad-Aware Scan
Please download Ad-Aware SE from here:
http://www.majorgeeks.com/download506.html
Install Ad-Aware and run it. In the bottom-right hand corner, click "Check for updates now". Click "Connect" to download the newest reference file.

Now we will configure Ad-Aware to perform a full scan. In the Ad-Aware main window, click on the gear icon at the top of the screen to open the preferences window. In the "General" window, make sure the following options are selected:
1) Automatically save log-file
2) Automatically quarantine objects prior to removal
3) Safe Mode (always request confirmation)

Click the "Scanning" button on the left-hand side and make sure the following options are selected:
1) Scan within archives
2) Scan active processes
3) Scan registry
4) Deep scan registry
4) Scan my IE Favorites for banned URLs
5) Scan my Hosts file

Please also click on "Select drives & folders to scan" and select your hard drive(s). Then click the "Advanced" button on the left-hand side and make sure all the options under "Log-file Detail Level" are selected. Next, click the "Tweak" button on the left-hand side. Click on "Scanning Engine" and make sure the following options are selected:
1) Unload recognized processes & modules during scanning
2) Obtain command line of scanned processes
3) Scan registry for all users instead of current user only

Click on "Cleaning Engine" and make sure the following options are selected:
1) Always try to unload modules before deletion
2) During removal, unload Explorer and IE if necessary
3) Let Windows remove files in use at next reboot
4) Delete quarantined objects after restoring

Finally, click on "Safety Settings" and make sure the following options are selected:
1) Automatically select problematic objects in results lists
2) Write-protect system files after repair (Hosts file, etc)

Click on "Proceed" to save the preferences. Then please click the "Start" button on the bottom right side to begin a scan. Select "Use custom scanning options" and then click "Next". Ad-Aware will then scan for malware. When it is finished, make sure any objects listed in RED are selected and click "Next" to remove the objects. Then please restart your computer.


Spybot Full Scan
Next, please download Spybot-S&D from here:
http://www.majorgeeks.com/download.php?det=2471
Install Spybot-S&D and run it. Select "Search for updates" and then select all available updates. Click on the drop-down box in the top center to choose a download location nearest to you. Then click "Download updates". When all updates have downloaded, close Spybot-S&D, and then run it again. Click on "Check for problems". When the scan has finished, select any entries listed in red and click "Fix selected problems". Then please restart your computer again.


Rescan one more time with Panda ActiveScan and post the log here. Keep it up, we are getting it soon.

Muzic713

i scanned w/ those two and here is the log:

Incident
Status
Location

Adware:adware/savenow
Not disinfected
Windows Registry

Adware:adware/popupsearches
Not disinfected
Windows Registry

chiaz

Download and run RegSupreme Pro:
http://www.macecraft.com/downloads/


It will want to make a backup of your cache, let it. Choose the Registry Cleaner tab, and select Aggressive. Once it has finished, click on Select, and choose All. Click on Fix, and allow it to fix everything that it finds. Reboot your PC.


Is your computer running well now?