Unable to open files

[The Rivan]

My PC has stopped opening all files except Internet Explorer, I either get a message saying : File.exe  app not found, or I am asked to choose a file to open with. What's wrong? and can I fix it?

[The Rivan]

It might have something to do with my spybot program..........

[Allan]

http://www.dougknox.com/xp/tips/xp_easy_file.htm

Also, spybot is old school - I suggest you uninstall it and use MalwareBytes instead.

[The Rivan]

Thanks but i can not get download to open, or unistall the old program. It just keeps saying File.exe  app not found...

[Allan]

The download is in text form. Just open it with notepad.

[The Rivan]

My computer wont let me even do that!

[Allan]

I'm moving this to the malware forum. Please wait for a malware specialist to respond.

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
************************************************
Sorry for the delay.
Please try this: Boot your computer in Safe Mode with Networking, download, install and run a scan with MBAM. Re-boot in Normal Mode and run another scan with MBAM. If successful, please try to run these programs.
Safe Mode

Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
***************************************************************
Please download  SREng

•   Extract it to Desktop and double click SREngLdr.EXE to run it
  
•   Select System Repair from the left pane.
  
• Click on File  Association
  
• Select all entries that has an Error  status click [Repair]
  
• Refer to this image for an  example:

•   In your case, it would be .EXE
  
• Close SREng now.

.
***********************************************************
SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.

[The Rivan]

Hello, these are the results of the scans you recommended. I can not do anything in normal mode still nor on my profile in safe mode, only the admin profile in safe mode will let me do anything. 



Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 7028

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

05/07/2011 20:26:50
mbam-log-2011-07-05 (20-26-50).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 284097
Time elapsed: 26 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 10
Registry Values Infected: 2
Registry Data Items Infected: 6
Folders Infected: 5
Files Infected: 13

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{D810B78A-D010-44DF-8445-AC58086B600E} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DbgMgr (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Value: UID -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RList (Malware.Trace) -> Value: RList -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("D:\Documents and Settings\Kate Byrne\Local Settings\Application Data\ene.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("D:\Documents and Settings\Kate Byrne\Local Settings\Application Data\ene.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("D:\Documents and Settings\Kate Byrne\Local Settings\Application Data\ene.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
d:\documents and settings\all users\application data\16948434 (Rogue.Multiple) -> Quarantined and deleted successfully.
d:\documents and settings\localservice\application data\twain_32 (Trojan.Zbot) -> Quarantined and deleted successfully.
c:\program files\browserctl (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec (Stolen.data) -> Quarantined and deleted successfully.

Files Infected:
c:\program files\msn messenger\msimg32.dll (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\program files\msn messenger\riched20.dll (PUP.FunWebProducts) -> Quarantined and deleted successfully.
d:\documents and settings\kate byrne\my documents\downloads\totalrecipesearch.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\RECYCLER\adapt_installer.exe (Trojan.Agent) -> Quarantined and deleted successfully.
d:\documents and settings\kate byrne\application data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
c:\program files\HPZUCI12.DLL (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\program files\tls704d.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\WINDOWS\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\prxid93ps.dat (Malware.Trace) -> Quarantined and deleted successfully.
d:\documents and settings\all users\application data\16948434\16948434 (Rogue.Multiple) -> Quarantined and deleted successfully.
d:\documents and settings\all users\application data\16948434\pc16948434ins (Rogue.Multiple) -> Quarantined and deleted successfully.
d:\documents and settings\localservice\application data\twain_32\user.ds (Trojan.Zbot) -> Quarantined and deleted successfully.
c:\program files\ddnsfilter\ddnsfilter.dll (Trojan.DNSChanger) -> Quarantined and deleted successfully.



----------------------------------------------------------------------------------

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/05/2011 at 10:19 PM

Application Version : 4.55.1000

Core Rules Database Version : 7373
Trace Rules Database Version: 5185

Scan type       : Complete Scan
Total Scan Time : 01:36:00

Memory items scanned      : 296
Memory threats detected   : 0
Registry items scanned    : 7136
Registry threats detected : 0
File items scanned        : 93110
File threats detected     : 301

Adware.Tracking Cookie
   D:\Documents and Settings\Administrator\Cookies\administrator@revsci[2].txt
   D:\Documents and Settings\Administrator\Cookies\administrator@2o7[1].txt
   D:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[2].txt
   ads1.msn.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   atdmt.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   b.ads1.msn.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   cdn5.specificclick.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   cloud.video.unrulymedia.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   crackle.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   d8.zedo.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   drawtoon.blocmedia.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   ds.serving-sys.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   ec.atdmt.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   emea.2mdn.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   findel.scene7.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   googleads.g.doubleclick.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   i.*adult URL* [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   ia.media-imdb.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   img-cdn.mediaplex.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   interclick.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   m.uk.2mdn.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   m1.2mdn.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   m1.emea.2mdn.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   macromedia.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   media.buto.tv [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   media.disneyinternational.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   media.gamegarage.co.uk [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   media.monster.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   media.scanscout.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   media.tattomedia.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   media1.break.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   media1.clubpenguin.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   mediaonenetwork.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   mediaplex.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   msntest.serving-sys.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   naiadsystems.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   oddcast.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   s0.2mdn.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   secure-uk.imrworldwide.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   serving-sys.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   spe.atdmt.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   stat.easydate.biz [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   static.2mdn.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   static.sexsearch.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   track.webgains.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   uk.2mdn.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   virginmedia.a.mms.mavenapps.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   www.gamecockmedia.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   www.opt-in-media.net [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   www.pornhub.com [ D:\Documents and Settings\Kate Byrne\Application Data\Macromedia\Flash Player\#SharedObjects\FHRHE3EQ ]
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@247realmedia[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@2o7[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][4].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@adbrite[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@adnet-media[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@adserveuk[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@adtech[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@adultswim[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@advertising[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@adviva[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@adxpose[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@apmebf[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@apmebf[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@atdmt[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@audience2media[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@audience2media[3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@azjmp[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@bizrate[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@bnbrevenue[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@bravenet[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@burstbeacon[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@clicksor[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@clubpenguintracker[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@collective-media[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@dmtracker[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@doubleclick[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@doubleclick[3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@eyewonder[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@fastclick[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@findaproperty[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@gostats[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@hitbox[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@imrworldwide[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@insightexpressai[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@interclick[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@invitemedia[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@jobinterviewquestions[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@kantarmedia[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@kontera[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@legolas-media[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@lfstmedia[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@linksynergy[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@liveperson[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@liveperson[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@liveperson[3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@liveperson[4].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@liveperson[5].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@liveperson[7].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@media6degrees[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@mediabrandsww[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@mediaplex[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@mediaplex[3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@myroitracking[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@mywebsearch[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@naiadsystems[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@nextag[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@overture[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@partyaccount[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@partypoker[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@popularscreensavers[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@pro-market[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@questionmarket[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@revsci[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@revsci[3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@ru4[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][5].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][6].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@serving-sys[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@socialmedia[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@specificclick[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@statcounter[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@tacoda[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@tns-counter[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@trackalyzer[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@tradedoubler[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@tradedoubler[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@trafficmp[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@tribalfusion[2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@tripod[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@user-activity-tracking[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@virginmedia[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@weborama[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][3].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][4].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][5].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][6].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][7].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\kate_byrne@xiti[1].txt
   D:\Documents and Settings\Kate Byrne\Cookies\[email protected][2].txt

Adware.MyWebSearch/FunWebProducts
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{B1C538C0-CBA3-4434-A006-53A338B37653}\RP1257\A0150822.DLL
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{B1C538C0-CBA3-4434-A006-53A338B37653}\RP1257\A0150823.DLL

Trojan.Agent/Gen-DDNS
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{B1C538C0-CBA3-4434-A006-53A338B37653}\RP1257\A0150828.DLL

Rogue.Agent/Gen-Nullo[DLL]
   C:\WINDOWS\EJEXEDYVAR.DLL

Rogue.Agent/Gen-Nullo[BIN]
   C:\WINDOWS\SYSTEM32\CYGOKUPIBY.BIN

Rogue.Agent/Gen-Nullo[EXE]
   C:\WINDOWS\WIPUDYJOC.EXE

[SuperDave]

I am required to give you this information

One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

Read this article: Danger: Remote Access Trojans.

If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one! If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

I would counsel you to disconnect this PC from the Internet immediately.

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall?

We can attempt to clean this machine but i can't guarantee that it will be 100% secure afterwards.

Should you have any questions, please feel free to ask.

Please let us know what you have decided to do in your next post

[The Rivan]

Hi there, thanks for all your help. We've decided to reboot our pc we have master disc's so this won't be a problem, but because we can't access anything do you think we can copy all the files we need from admin safe mode or will we have to remove the Trojan backdoors first, in order to copy the files?

[SuperDave]

do you think we can copy all the files we need from admin safe mode or will we have to remove the Trojan backdoors first, in order to copy the files?

Yes, try to salvage as many of your personel files as possible. I would recomment that you save to CD or DVD-RW's. That way you can erase them when your finished. Be sure to scan them with your AV before putting them back on your computer. Also, scan them with SAS and MBAM. The backdoor trojans have been removed but there's no telling how long they were on the computer.