Installing Spybot ( other programs without internet access? )

[evilfantasy]

Yes Widtangent could have come on the PC as a factory third party install, it's nothing to worry about at this point.

Did you see the part that said:

"Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them."

And the quote from sUBs

"Pulling the tool till further notice."

If the tool were pulled you wouldn't be able to download it.

Please follow the directions and post the ComboFix log.

[Kryptonite]

ComboFix 08-08-07.05 - Smokey 2008-08-07 20:24:11.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.550 [GMT -4:00]
Running from: C:\Documents and Settings\Smokey\Desktop\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\Faith\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\Guest\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\Smokey\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000011_.tmp.dll
C:\WINDOWS\system32\_000012_.tmp.dll
D:\Autorun.inf

.
(((((((((((((((((((((((((   Files Created from 2008-07-08 to 2008-08-08  )))))))))))))))))))))))))))))))
.

2008-08-07 19:33 . 2008-08-07 19:33   <DIR>   d--------   C:\Deckard
2008-08-07 10:31 . 2008-08-07 10:31   1,160   --a------   C:\WINDOWS\mozver.dat
2008-08-07 10:30 . 2008-08-07 11:50   <DIR>   d--------   C:\Documents and Settings\Smokey\.housecall6.6
2008-08-06 01:05 . 2008-08-06 01:29   <DIR>   d--------   C:\WINDOWS\system32\CatRoot_bak
2008-08-06 00:29 . 2008-06-13 09:10   272,128   ---------   C:\WINDOWS\system32\drivers\bthport.sys
2008-08-06 00:29 . 2008-06-13 09:10   272,128   ---------   C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-05 23:09 . 2008-08-07 20:26   1,048,608   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-05 23:09 . 2008-08-07 20:16   13,052   --ahs----   C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-05 23:06 . 2008-08-05 23:06   <DIR>   d--------   C:\Program Files\ZoneAlarmSB
2008-08-05 23:05 . 2008-08-05 23:05   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-08-05 23:05 . 2008-07-09 09:05   75,248   --a------   C:\WINDOWS\zllsputility.exe
2008-08-05 23:05 . 2004-04-27 04:40   11,264   --a------   C:\WINDOWS\system32\SpOrder.dll
2008-08-05 23:05 . 2008-08-05 23:07   4,212   ---h-----   C:\WINDOWS\system32\zllictbl.dat
2008-08-05 23:04 . 2008-08-05 23:05   <DIR>   d--------   C:\WINDOWS\system32\ZoneLabs
2008-08-05 23:04 . 2008-08-05 23:04   <DIR>   d--------   C:\Program Files\Zone Labs
2008-08-05 23:04 . 2008-07-09 09:05   1,086,952   --a------   C:\WINDOWS\system32\zpeng24.dll
2008-08-05 23:04 . 2008-08-07 20:18   352,918   --a------   C:\WINDOWS\system32\vsconfig.xml
2008-08-05 23:00 . 2008-08-07 20:21   <DIR>   d--------   C:\WINDOWS\Internet Logs
2008-08-05 22:59 . 2008-08-05 22:59   <DIR>   d--------   C:\Documents and Settings\Smokey\Application Data\Apple Computer
2008-08-05 22:12 . 2008-08-05 22:12   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-08-05 22:11 . 2008-08-05 22:11   <DIR>   d--------   C:\Program Files\SUPERAntiSpyware
2008-08-05 22:11 . 2008-08-05 22:11   <DIR>   d--------   C:\Documents and Settings\Smokey\Application Data\SUPERAntiSpyware.com
2008-08-05 22:09 . 2008-08-05 22:09   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2008-08-05 20:38 . 2008-08-05 20:38   <DIR>   d--------   C:\Program Files\Spybot - Search & Destroy
2008-08-05 20:38 . 2008-08-05 21:02   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-05 18:03 . 2008-08-05 18:03   <DIR>   d--------   C:\Documents and Settings\Smokey\Application Data\Talkback
2008-08-05 11:31 . 2008-08-05 11:31   <DIR>   d--------   C:\Program Files\Malwarebytes' Anti-Malware
2008-08-05 11:31 . 2008-08-05 11:31   <DIR>   d--------   C:\Documents and Settings\Smokey\Application Data\Malwarebytes
2008-08-05 11:31 . 2008-08-05 11:31   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-05 11:31 . 2008-07-30 20:14   38,472   --a------   C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-05 11:31 . 2008-07-30 20:14   17,144   --a------   C:\WINDOWS\system32\drivers\mbam.sys
2008-08-05 09:49 . 2008-08-05 09:49   <DIR>   d--------   C:\Program Files\XoftSpySE
2008-08-05 00:06 . 2008-08-05 00:06   <DIR>   d--------   C:\Documents and Settings\Smokey\Application Data\HPQ
2008-08-04 21:26 . 2008-08-04 21:49   <DIR>   d--------   C:\Documents and Settings\Smokey\DoctorWeb
2008-08-04 20:11 . 2006-10-09 15:50   <DIR>   d--------   C:\Documents and Settings\Smokey\WINDOWS
2008-08-04 20:11 . 2006-10-09 15:52   <DIR>   d--------   C:\Documents and Settings\Smokey\Application Data\Intuit
2008-08-04 20:11 . 2008-08-07 10:30   <DIR>   d--------   C:\Documents and Settings\Smokey
2008-08-04 19:13 . 2008-08-04 19:24   <DIR>   d--------   C:\Documents and Settings\Faith\DoctorWeb
2008-08-04 18:40 . 2008-08-04 18:40   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-08-04 18:37 . 2008-08-04 21:22   <DIR>   d--------   C:\SDFix
2008-08-04 08:52 . 2008-08-04 08:52   <DIR>   d--------   C:\Documents and Settings\Faith\Application Data\CyberLink
2008-08-04 08:44 . 2008-08-05 11:20   <DIR>   d--------   C:\Program Files\EndItAll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-06 04:34   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-06 02:40   ---------   d-----w   C:\Program Files\DivX
2008-08-05 04:39   ---------   d-----w   C:\Program Files\music_now
2008-08-05 04:39   ---------   d-----w   C:\Program Files\MSN Encarta Standard
2008-08-05 04:39   ---------   d-----w   C:\Program Files\Microsoft Works
2008-08-05 00:12   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-20 17:41   245,248   ----a-w   C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41   245,248   ----a-w   C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41   148,992   ----a-w   C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45   360,320   ----a-w   C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45   360,320   ----a-w   C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44   138,368   ----a-w   C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44   138,368   ----a-w   C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52   225,920   ----a-w   C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52   225,920   ----a-w   C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-05-08 12:28   202,752   ----a-w   C:\WINDOWS\system32\dllcache\rmcast.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-11 02:25 68856]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 17:01 67584]
"DMAScheduler"="c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 05:05 90112]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 18:14 237568]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 18:34 249856]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-13 22:23 663552]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-02-16 00:56 1398024]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-28 09:45 185896]
"ftutil2"="ftutil2.dll" [2004-06-07 10:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-13 16:05 16239616 C:\WINDOWS\RTHDCPL.EXE]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 19:19 77312 C:\WINDOWS\arpwrmsg.exe]

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\
Pin.lnk - C:\hp\bin\CLOAKER.EXE [2006-10-09 15:00:04 27136]
PinMcLnk.lnk - C:\hp\bin\cloaker.exe [2006-10-09 15:00:04 27136]

C:\Documents and Settings\Faith\Start Menu\Programs\Startup\
PinMcLnk.lnk - C:\hp\bin\cloaker.exe [2006-10-09 15:00:04 27136]

C:\Documents and Settings\Guest\Start Menu\Programs\Startup\
PinMcLnk.lnk - C:\hp\bin\cloaker.exe [2006-10-09 15:00:04 27136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk
backup=C:\WINDOWS\pss\Updates From HP.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Smokey^Start Menu^Programs^Startup^PinMcLnk.lnk]
path=C:\Documents and Settings\Smokey\Start Menu\Programs\Startup\PinMcLnk.lnk
backup=C:\WINDOWS\pss\PinMcLnk.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-05-08 16:24 54840 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDFix]
--a------ 2008-08-03 04:05 711592 C:\SDFix\RunThis.bat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-04-28 09:45 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=


*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-08-04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-08 C:\WINDOWS\Tasks\XoftSpySE 2.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [2008-07-31 15:05]

2008-08-05 C:\WINDOWS\Tasks\XoftSpySE.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [2008-07-31 15:05]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-kdikh.exe - C:\WINDOWS\system32\kdikh.exe
HKLM-Run-PCDrProfiler - (no file)
MSConfigStartUp-VirusHeat 4 - C:\Program Files\VirusHeat 4.4\VirusHeat 4.4.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Smokey\Application Data\Mozilla\Firefox\Profiles\3uy39rbu.default\


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-07 20:32:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-07 20:33:31
ComboFix-quarantined-files.txt  2008-08-08 00:33:28

Pre-Run: 220,107,415,552 bytes free
Post-Run: 221,556,416,512 bytes free

200   --- E O F ---   2008-03-21 01:00:38

[evilfantasy]

I would suggest uninstalling XoftSpySE. It is not a trusted program and is known to report false positives in order to get users to buy the full version.

----------

Download

OTMoveIt2 by OldTimer

• Save it to your desktop.

Note: If you are running on Vista, right-click on OTMoveIt2.exe and choose Run As Administrator.

• Double-click OTMoveIt2.exe to run it.
  
• Copy the lines in the codebox below.

[/list]

Code: [Select]

[kill explorer]
C:\SDFix
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDFix
EmptyTemp
[start explorer]

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) and paste it in your next reply.
  
• Close OTMoveIt2
.
----------


• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.

• The above procedure will:
• Delete the following:
• ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

.
----------

Run CCleaner.

Run the Kaspersky Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon and choose Run as Administrator.

• Click on SCAN NOW
  
• Click Accept.
  
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  
• The scan will take a while, so be patient and let it finish.

When the scan is done, in the Scan is complete window, any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

Copy and paste the Kaspersky Online Scanner Report in your next reply.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

-----------

Next post add
Kaspersky log

Also let me know how things are now.[/list]

[Kryptonite]

All in all the computer is running noticably better. However there's a couple of quirks that i think i should mention: the screne goes black for a few seconds then comes back, the pointer snaps back to the lower right corner from time to time, today Firefox just closed on me in the middle of typing a note to Trendmicro, and while typing another on site note to Walmart the cursor jumped back after typing "s" and "w" making the note unreadable. Besides that everything is just peachy.
Do i update with service pack 3? Any other updates that i should know about?

[evilfantasy]

Lets get the Kaspersky results just to be sure there is no more malware left. You don't want to update to SP3 if malware is present.

The mouse sounds like a hardware problem but I'm not sure. You can adjust the settings. Or make sure the surface you are using is completely free of all foreign objects including dust. Then again I've had a few mice do that. Turns out they were either too old, or a cheap off brand and buying a new $20 Microsoft mouse from Wal Mart was the only thing that cleared it up.

How to Adjust Mouse Settings - http://www.ehow.com/how_2186329_adjust-mouse-settings.html

[Kryptonite]

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
 Friday, August 8, 2008
 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
 Kaspersky Online Scanner 7 version: 7.0.25.0
 Program database last update: Friday, August 08, 2008 02:22:23
 Records in database: 1068436
--------------------------------------------------------------------------------

Scan settings:
   Scan using the following database: extended
   Scan archives: yes
   Scan mail databases: yes

Scan area - My Computer:
   C:\
   D:\
   E:\
   F:\
   G:\
   H:\
   I:\

Scan statistics:
   Files scanned: 77360
   Threat name: 6
   Infected objects: 26
   Suspicious objects: 0
   Duration of the scan: 01:46:55


File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34B61436.htm   Infected: Exploit.HTML.Mht   1
C:\Documents and Settings\Smokey\DoctorWeb\Quarantine\A0153294.exe   Infected: not-a-virus:AdWare.Win32.WeatherBug.a   2
C:\Documents and Settings\Smokey\DoctorWeb\Quarantine\A0153298.exe   Infected: not-a-virus:AdWare.Win32.WeatherBug.a   2
C:\Documents and Settings\Smokey\DoctorWeb\Quarantine\A0153299.exe   Infected: not-a-virus:AdWare.Win32.WeatherBug.a   2
C:\Documents and Settings\Smokey\DoctorWeb\Quarantine\CompaqPresario_Spring06.exe   Infected: not-a-virus:AdWare.Win32.WeatherBug.a   2
C:\Documents and Settings\Smokey\DoctorWeb\Quarantine\HPPavillion_Spring00.exe   Infected: not-a-virus:AdWare.Win32.WeatherBug.a   2
C:\Documents and Settings\Smokey\DoctorWeb\Quarantine\HPPavillion_Spring06.exe   Infected: not-a-virus:AdWare.Win32.WeatherBug.a   2
C:\Program Files\IncrediMail\bin\IncrediMail_Install.exe   Infected: not-a-virus:Downloader.Win32.ImLoader.k   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B08.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B09.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B0C.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B0D.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B0E.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B0F.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B10.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B11.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1B12.tmp   Infected: Trojan-Downloader.Win32.Zlob.knf   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1D.tmp   Infected: Trojan-Downloader.Win32.Delf.igd   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\1E.tmp   Infected: Trojan-Downloader.Win32.Delf.igd   1
C:\Program Files\Trend Micro\Internet Security\Quarantine\WinSpyKillerSetup[1].exe   Infected: Trojan-Downloader.Win32.FraudLoad.atp   1

The selected area was scanned.

[Kryptonite]

CLEANING COMPLETE - (8.654 secs)
------------------------------------------------------------------------------------------
30.2MB removed.
------------------------------------------------------------------------------------------

Details of files deleted
------------------------------------------------------------------------------------------
IE Temporary Internet Files (265 files) 2.48MB
C:\Documents and Settings\Smokey\Cookies\smokey@google[2].txt 322 bytes
C:\Documents and Settings\Smokey\Cookies\smokey@google[1].txt 133 bytes
C:\Documents and Settings\Smokey\Cookies\smokey@tribalfusion[1].txt 187 bytes
C:\Documents and Settings\Smokey\Cookies\smokey@microsoft[2].txt 234 bytes
C:\Documents and Settings\Smokey\Cookies\smokey@ccleaner[2].txt 356 bytes
C:\Documents and Settings\Smokey\Cookies\[email protected][2].txt 186 bytes
C:\Documents and Settings\Smokey\Cookies\[email protected][2].txt 145 bytes
C:\Documents and Settings\Smokey\Cookies\smokey@atdmt[2].txt 102 bytes
C:\Documents and Settings\Smokey\Cookies\smokey@att[1].txt 84 bytes
C:\Documents and Settings\Smokey\Local Settings\History\History.IE5\MSHist012008080420080805\index.dat 32.00KB
C:\Documents and Settings\Smokey\Local Settings\History\History.IE5\MSHist012008080520080806\index.dat 48.00KB
C:\Documents and Settings\Smokey\Local Settings\History\History.IE5\MSHist012008080620080807\index.dat 32.00KB
C:\Documents and Settings\Smokey\Local Settings\History\History.IE5\MSHist012008080720080808\index.dat 48.00KB
Marked for deletion: C:\Documents and Settings\Smokey\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marked for deletion: C:\Documents and Settings\Smokey\Cookies\index.dat
Marked for deletion: C:\Documents and Settings\Smokey\Local Settings\History\History.IE5\desktop.ini
Marked for deletion: C:\Documents and Settings\Smokey\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\Smokey\Recent\2adcf8cef56bd93eadd84f.lnk 464 bytes
C:\Documents and Settings\Smokey\Recent\DrWeb.lnk 796 bytes
C:\Documents and Settings\Smokey\Recent\DrWeb2.lnk 278 bytes
C:\Documents and Settings\Smokey\Recent\DrWeb2a.lnk 281 bytes
C:\Documents and Settings\Smokey\Recent\focus.lnk 788 bytes
C:\Documents and Settings\Smokey\Recent\hijackthis2.lnk 295 bytes
C:\Documents and Settings\Smokey\Recent\hijackthis3 after.lnk 321 bytes
C:\Documents and Settings\Smokey\Recent\logCFix7Aug08.lnk 1.00KB
C:\Documents and Settings\Smokey\Recent\Logs.lnk 1,021 bytes
C:\Documents and Settings\Smokey\Recent\LOGz.lnk 538 bytes
C:\Documents and Settings\Smokey\Recent\mbam-log-8-5-2008 (11-47-22).lnk 366 bytes
C:\Documents and Settings\Smokey\Recent\mbam-log-8-5-2008 (11-48-34)after.lnk 385 bytes
C:\Documents and Settings\Smokey\Recent\mbam-log-8-5-2008 (13-11-38).lnk 366 bytes
C:\Documents and Settings\Smokey\Recent\mbam-log-8-5-2008 (13-11-56)2.lnk 1.32KB
C:\Documents and Settings\Smokey\Recent\mbam-log-8-6-2008 (08-14-02)b.lnk 1.32KB
C:\Documents and Settings\Smokey\Recent\msxml4-KB927978-enu.lnk 686 bytes
C:\Documents and Settings\Smokey\Recent\Norton Internet Security_2006_Key.lnk 930 bytes
C:\Documents and Settings\Smokey\Recent\OldTimer log.lnk 743 bytes
C:\Documents and Settings\Smokey\Recent\Scan reports.lnk 562 bytes
C:\Documents and Settings\Smokey\Recent\SDFix log.lnk 289 bytes
C:\Documents and Settings\Smokey\Recent\Sounds.lnk 620 bytes
C:\Documents and Settings\Smokey\Recent\Symantec.lnk 560 bytes
C:\Documents and Settings\Smokey\Recent\TRAVELDRIVE (J).lnk 190 bytes
Emptied Recycle Bin (2 files) 962 bytes
C:\WINDOWS\MiniDump\Mini010108-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini010308-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini010508-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini010608-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini010708-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini010808-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini011208-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini011308-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini011308-02.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini011508-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini012208-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini020308-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini020308-02.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini020408-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini020607-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini020908-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini040207-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini040407-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini040407-02.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini041907-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini051207-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini052307-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini061807-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini070507-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini080508-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini082107-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini082307-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini082407-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini082507-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini082607-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini090707-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini092307-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini092507-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini092907-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini092907-02.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini100107-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini100707-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini100807-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini100907-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini101007-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini101107-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini102407-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini111407-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini111507-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini111807-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini111807-02.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini112007-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini120407-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini120507-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini120507-02.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini120607-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini120707-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini120707-02.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini120807-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini120907-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini121107-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini121207-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini121407-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini121607-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini122007-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini122107-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini122307-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini122407-01.dmp 92.00KB
C:\WINDOWS\MiniDump\Mini122507-01.dmp 92.00KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 47.69KB
C:\WINDOWS\system32\wbem\Logs\mofcomp.log 11.60KB
C:\WINDOWS\system32\wbem\Logs\replog.log 400 bytes
C:\WINDOWS\system32\wbem\Logs\setup.log 4.84KB
C:\WINDOWS\system32\wbem\Logs\wbemcore.log 142 bytes
C:\WINDOWS\system32\wbem\Logs\wbemess.log 27.13KB
C:\WINDOWS\system32\wbem\Logs\wbemprox.log 18.64KB
C:\WINDOWS\system32\wbem\Logs\wmiadap.log 3.79KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 55.73KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.lo_ 64.08KB
C:\WINDOWS\system32\wbem\Logs\wbemess.lo_ 64.13KB
C:\WINDOWS\system32\wbem\Logs\wbemprox.lo_ 64.07KB

[Kryptonite]

C:\WINDOWS\0.log 0 bytes
C:\WINDOWS\AwayMode160.log 5.28KB
C:\WINDOWS\cmsetacl.log 200 bytes
C:\WINDOWS\COM+.log 2.83KB
C:\WINDOWS\comsetup.log 0.28MB
C:\WINDOWS\DHCPUPG.LOG 178 bytes
C:\WINDOWS\DPINST.LOG 20.86KB
C:\WINDOWS\DtcInstall.log 1.57KB
C:\WINDOWS\ehOCGen.log 47.31KB
C:\WINDOWS\EventSystem.log 13.63KB
C:\WINDOWS\FaxSetup.log 0.82MB
C:\WINDOWS\GEARInstall.log 121 bytes
C:\WINDOWS\IDNMitigationAPIs.log 6.89KB
C:\WINDOWS\ie7.log 58.47KB
C:\WINDOWS\ie7_main.log 22.86KB
C:\WINDOWS\iis6.log 0.91MB
C:\WINDOWS\imsins.log 1.32KB
C:\WINDOWS\KB873339.log 6.40KB
C:\WINDOWS\KB883667.log 5.00KB
C:\WINDOWS\KB885250.log 6.60KB
C:\WINDOWS\KB885835.log 7.18KB
C:\WINDOWS\KB885836.log 6.88KB
C:\WINDOWS\KB886185.log 10.35KB
C:\WINDOWS\KB887472.log 6.32KB
C:\WINDOWS\KB887742.log 6.48KB
C:\WINDOWS\KB887998.log 7.33KB
C:\WINDOWS\KB888111.log 6.61KB
C:\WINDOWS\KB888113.log 6.40KB
C:\WINDOWS\KB888302.log 15.13KB
C:\WINDOWS\KB888795.log 9.10KB
C:\WINDOWS\KB890175.log 6.80KB
C:\WINDOWS\KB890859.log 30.23KB
C:\WINDOWS\KB890859Uninst.log 2.24KB
C:\WINDOWS\KB891593.log 5.56KB
C:\WINDOWS\KB891781.log 5.13KB
C:\WINDOWS\KB892050.log 5.88KB
C:\WINDOWS\KB892130.log 12.48KB
C:\WINDOWS\KB893066.log 6.06KB
C:\WINDOWS\KB893357.log 5.38KB
C:\WINDOWS\KB893756.log 16.00KB
C:\WINDOWS\KB893803v2.log 6.08KB
C:\WINDOWS\KB895961.log 5.47KB
C:\WINDOWS\KB896358.log 8.00KB
C:\WINDOWS\KB896422.log 7.65KB
C:\WINDOWS\KB896423.log 37.67KB
C:\WINDOWS\KB896423Uninst.log 1.62KB
C:\WINDOWS\KB896424.log 7.16KB
C:\WINDOWS\KB896428.log 15.37KB
C:\WINDOWS\KB898458.log 5.99KB
C:\WINDOWS\KB898461.log 6.84KB
C:\WINDOWS\KB899337.log 8.87KB
C:\WINDOWS\KB899510.log 8.30KB
C:\WINDOWS\KB899587.log 45.83KB
C:\WINDOWS\KB899587Uninst.log 1.62KB
C:\WINDOWS\KB899591.log 16.14KB
C:\WINDOWS\KB900325.log 24.31KB
C:\WINDOWS\KB900485.log 16.72KB
C:\WINDOWS\KB900725.log 32.31KB
C:\WINDOWS\KB900725Uninst.log 1.75KB
C:\WINDOWS\KB901017.log 15.82KB
C:\WINDOWS\KB901214.log 7.45KB
C:\WINDOWS\KB902400.log 20.40KB
C:\WINDOWS\KB902841.log 9.27KB
C:\WINDOWS\KB903157.log 4.57KB
C:\WINDOWS\KB904706.log 17.02KB
C:\WINDOWS\KB904942.log 15.71KB
C:\WINDOWS\KB905414.log 34.94KB
C:\WINDOWS\KB905414Uninst.log 1.62KB
C:\WINDOWS\KB905749.log 29.09KB
C:\WINDOWS\KB905749Uninst.log 1.62KB
C:\WINDOWS\KB906569.log 4.82KB
C:\WINDOWS\KB908246.log 5.44KB
C:\WINDOWS\KB908519.log 19.04KB
C:\WINDOWS\KB908531.log 18.72KB
C:\WINDOWS\KB910393.log 5.09KB
C:\WINDOWS\KB910437.log 26.04KB
C:\WINDOWS\KB910437Uninst.log 1.74KB
C:\WINDOWS\KB911280.log 15.51KB
C:\WINDOWS\KB911562.log 18.94KB
C:\WINDOWS\KB911565.log 6.52KB
C:\WINDOWS\KB911927.log 40.14KB
C:\WINDOWS\KB911927Uninst.log 1.75KB
C:\WINDOWS\KB912024.log 19.85KB
C:\WINDOWS\KB912067.log 19.74KB
C:\WINDOWS\KB912812.log 30.59KB
C:\WINDOWS\KB912919.log 18.52KB
C:\WINDOWS\KB912945.log 11.83KB
C:\WINDOWS\KB913580.log 30.00KB
C:\WINDOWS\KB913580Uninst.log 2.65KB
C:\WINDOWS\KB913800.log 31.24KB
C:\WINDOWS\KB913800Uninst.log 5.93KB
C:\WINDOWS\KB914388.log 36.15KB
C:\WINDOWS\KB914388Uninst.log 2.14KB
C:\WINDOWS\KB914389.log 16.65KB
C:\WINDOWS\KB914440.log 7.46KB
C:\WINDOWS\KB915865.log 8.95KB
C:\WINDOWS\KB916595.log 15.71KB
C:\WINDOWS\KB917344.log 35.17KB
C:\WINDOWS\KB917344Uninst.log 1.75KB
C:\WINDOWS\KB917422.log 15.83KB
C:\WINDOWS\KB917734.log 30.83KB
C:\WINDOWS\KB917734Uninst.log 2.24KB
C:\WINDOWS\KB917953.log 15.83KB
C:\WINDOWS\KB918118.log 16.03KB
C:\WINDOWS\KB918439.log 15.69KB
C:\WINDOWS\KB919007.log 15.83KB
C:\WINDOWS\KB920213.log 36.91KB
C:\WINDOWS\KB920213Uninst.log 2.00KB
C:\WINDOWS\KB920670.log 15.50KB
C:\WINDOWS\KB920683.log 27.90KB
C:\WINDOWS\KB920683Uninst.log 1.95KB
C:\WINDOWS\KB920685.log 15.69KB
C:\WINDOWS\KB920872.log 17.40KB
C:\WINDOWS\KB921398.log 37.06KB
C:\WINDOWS\KB921398Uninst.log 1.82KB
C:\WINDOWS\KB921503.log 19.38KB
C:\WINDOWS\KB922582.log 23.84KB
C:\WINDOWS\KB922582Uninst.log 2.19KB
C:\WINDOWS\KB922616.log 39.64KB
C:\WINDOWS\KB922616Uninst.log 1.75KB
C:\WINDOWS\KB922819.log 42.23KB
C:\WINDOWS\KB922819Uninst.log 1.98KB
C:\WINDOWS\KB923191.log 13.59KB
C:\WINDOWS\KB923414.log 15.83KB
C:\WINDOWS\KB923689.log 9.04KB
C:\WINDOWS\KB923694.log 16.23KB
C:\WINDOWS\KB923723.log 9.04KB
C:\WINDOWS\KB923980.log 16.38KB
C:\WINDOWS\KB924191.log 42.31KB
C:\WINDOWS\KB924191Uninst.log 1.75KB
C:\WINDOWS\KB924270.log 39.31KB
C:\WINDOWS\KB924270Uninst.log 2.11KB
C:\WINDOWS\KB924496.log 44.34KB
C:\WINDOWS\KB924496Uninst.log 1.68KB
C:\WINDOWS\KB924667.log 14.40KB
C:\WINDOWS\KB925398.log 7.65KB
C:\WINDOWS\KB925454.log 80.87KB
C:\WINDOWS\KB925454Uninst.log 3.89KB
C:\WINDOWS\KB925486.log 16.09KB
C:\WINDOWS\KB925902.log 13.14KB
C:\WINDOWS\KB926251.log 4.80KB
C:\WINDOWS\KB926255.log 31.30KB
C:\WINDOWS\KB926255Uninst.log 1.74KB
C:\WINDOWS\KB926436.log 16.63KB
C:\WINDOWS\KB927779.log 20.99KB
C:\WINDOWS\KB927802.log 18.15KB
C:\WINDOWS\KB927891.log 8.12KB
C:\WINDOWS\KB928090.log 33.53KB
C:\WINDOWS\KB928255.log 17.81KB
C:\WINDOWS\KB928843.log 12.28KB
C:\WINDOWS\KB929123.log 12.82KB
C:\WINDOWS\KB929338.log 12.89KB
C:\WINDOWS\KB929969.log 21.47KB
C:\WINDOWS\KB930178.log 13.45KB
C:\WINDOWS\KB930494.log 6.28KB
C:\WINDOWS\KB930916.log 12.92KB
C:\WINDOWS\KB931261.log 13.15KB
C:\WINDOWS\KB931768.log 17.81KB
C:\WINDOWS\KB931784.log 15.06KB
C:\WINDOWS\KB931836.log 26.60KB
C:\WINDOWS\KB932168.log 16.00KB
C:\WINDOWS\KB932823-v3.log 14.98KB
C:\WINDOWS\KB933360.log 22.50KB
C:\WINDOWS\KB933566-IE7.log 24.95KB
C:\WINDOWS\KB933566.log 33.62KB
C:\WINDOWS\KB933729.log 13.88KB
C:\WINDOWS\KB935448.log 8.68KB
C:\WINDOWS\KB935839.log 12.14KB
C:\WINDOWS\KB935840.log 12.17KB
C:\WINDOWS\KB936021.log 20.48KB
C:\WINDOWS\KB936357.log 12.28KB
C:\WINDOWS\KB936782.log 5.82KB
C:\WINDOWS\KB937143-IE7.log 23.55KB
C:\WINDOWS\KB937894.log 20.02KB
C:\WINDOWS\KB938127-IE7.log 13.07KB
C:\WINDOWS\KB938828.log 20.00KB
C:\WINDOWS\KB938829.log 19.18KB
C:\WINDOWS\KB939653-IE7.log 23.29KB
C:\WINDOWS\KB941202.log 11.33KB
C:\WINDOWS\KB941568.log 16.08KB
C:\WINDOWS\KB941569.log 13.21KB
C:\WINDOWS\KB941644.log 12.50KB
C:\WINDOWS\KB941693.log 12.99KB
C:\WINDOWS\KB942615-IE7.log 24.18KB
C:\WINDOWS\KB942763.log 30.61KB
C:\WINDOWS\KB943055.log 12.73KB
C:\WINDOWS\KB943460.log 8.22KB
C:\WINDOWS\KB943485.log 12.58KB
C:\WINDOWS\KB944533-IE7.log 24.86KB
C:\WINDOWS\KB944653.log 12.41KB
C:\WINDOWS\KB945553.log 13.95KB
C:\WINDOWS\KB946026.log 19.31KB
C:\WINDOWS\KB948590.log 14.33KB
C:\WINDOWS\KB950749.log 17.16KB
C:\WINDOWS\KB950759-IE7.log 24.93KB
C:\WINDOWS\KB950760.log 9.45KB
C:\WINDOWS\KB950762.log 11.01KB
C:\WINDOWS\KB951376-v2.log 22.03KB
C:\WINDOWS\KB951698.log 33.90KB
C:\WINDOWS\KB951748.log 33.09KB
C:\WINDOWS\MCSetup.log 2.38KB
C:\WINDOWS\MCSetup_UI.log 1.51KB
C:\WINDOWS\medblker.Log 1.62KB
C:\WINDOWS\MedCtrOC.log 0.10MB
C:\WINDOWS\msgsocm.log 41.57KB
C:\WINDOWS\msmqinst.log 0.25MB
C:\WINDOWS\msxml4-KB936181-enu.LOG 0.28MB
C:\WINDOWS\netfxocm.log 0.15MB
C:\WINDOWS\NLSDownlevelMapping.log 6.55KB
C:\WINDOWS\ntdtcsetup.log 0.17MB
C:\WINDOWS\ocgen.log 0.40MB
C:\WINDOWS\ocmsn.log 45.73KB
C:\WINDOWS\plusoc.log 97.78KB
C:\WINDOWS\regopt.log 3.29KB
C:\WINDOWS\sessmgr.setup.log 2.67KB
C:\WINDOWS\setupact.log 0.34MB
C:\WINDOWS\setupapi.log 37.05KB
C:\WINDOWS\setuperr.log 399 bytes
C:\WINDOWS\spupdsvc.log 42.14KB
C:\WINDOWS\SpywareDoctor5Uninstall.log 998 bytes
C:\WINDOWS\svcpack.log 51.73KB
C:\WINDOWS\tabletoc.log 41.35KB
C:\WINDOWS\TmComm.log 0.48MB
C:\WINDOWS\tmevtmgr.log 13.01KB
C:\WINDOWS\TMFilter.log 2.87KB
C:\WINDOWS\tsoc.log 0.38MB
C:\WINDOWS\updspapi.log 0.13MB
C:\WINDOWS\WgaNotify.log 6.02KB
C:\WINDOWS\WINNT32.LOG 15.94KB
C:\WINDOWS\wmsetup.log 39.07KB
C:\WINDOWS\wmsetup10.log 236 bytes
C:\WINDOWS\wsdu.log 35.33KB
C:\WINDOWS\xpsp1hfm.log 1.05KB
C:\WINDOWS\imsins.BAK 1.32KB
C:\WINDOWS\ntbtlog.txt 0.25MB
C:\WINDOWS\OEWABLog.txt 2.50KB
C:\WINDOWS\setuplog.txt 0.99MB
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log 5.82MB
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp 64.56KB
C:\WINDOWS\Debug\blastcln.log 286 bytes
C:\WINDOWS\Debug\mrt.log 9.97KB
C:\WINDOWS\Debug\mrteng.log 6.80KB
C:\WINDOWS\Debug\NetSetup.LOG 4.27KB
C:\WINDOWS\Debug\UserMode\userenv.log 0.13MB
C:\WINDOWS\Debug\UserMode\userenv.bak 0.34MB
C:\WINDOWS\security\logs\backup.log 2.72KB
C:\WINDOWS\security\logs\ProfSec.log 7.81KB
C:\WINDOWS\security\logs\SceRoot.log 588 bytes
C:\WINDOWS\security\logs\scesetup.log 0.39MB
C:\WINDOWS\security\logs\scecomp.old 228 bytes
Removed Cookie: geekstogo.com
Removed Cookie: computerhope.com
Removed Cookie: intellitxt.com
Removed Cookie: www.bleepingcomputer.com
Removed Cookie: bleepingcomputer.com
Removed Cookie: quantserve.com
Removed Cookie: google.com
Removed Cookie: housecall65.trendmicro.com
Removed Cookie: us.trendmicro.com
Removed Cookie: ask.com
Removed Cookie: mozilla.com
Removed Cookie: directory-assistance.net
Removed Cookie: thelist.com
Removed Cookie: 2o7.net
Removed Cookie: ad.yieldmanager.com
Removed Cookie: walmart.com
Removed Cookie: yahoo.com
Removed Cookie: atdmt.com
Removed Cookie: doubleclick.net
Removed Cookie: walmartwom.com
Removed Cookie: housecall.trendmicro.com
Removed Cookie: trialpay.com
Removed Cookie: did-it.com
Removed Cookie: server.iad.liveperson.net
Removed Cookie: statse.webtrendslive.com
Removed Cookie: mediaplex.com
Removed Cookie: askredir.com
Removed Cookie: snapfiles.com
Removed Cookie: techspot.com
Removed Cookie: www.techspot.com
Removed Cookie: com.com
Removed Cookie: tribalfusion.com
Removed Cookie: xiti.com
Removed Cookie: computing.net
Removed Cookie: apmebf.com
Removed Cookie: techsupportforum.com
Removed Cookie: www.techsupportforum.com
Removed Cookie: www.perfectuninstaller.com
Removed Cookie: clickbank.net
Removed Cookie: pcauthorities.com
Removed Cookie: www.googleadservices.com
Removed Cookie: aus2.mozilla.org
Removed Cookie: att.com
Removed Cookie: cnet.com
Removed Cookie: download.com
Removed Cookie: experts-exchange.com
Removed Cookie: pcmag.com
Removed Cookie: pctools.com
Removed Cookie: download.mozilla.org
Removed Cookie: www.pcmag.com
C:\Documents and Settings\Smokey\Application Data\Mozilla\Firefox\Profiles\3uy39rbu.default\downloads.rdf 8.93KB
Firefox/Mozilla Temporary Internet Cache (22 files) 4.11MB
C:\Documents and Settings\Smokey\Application Data\Mozilla\Firefox\Profiles\3uy39rbu.default\history.dat 0.12MB
C:\Documents and Settings\Smokey\Application Data\Microsoft\Office\Recent\Desktop.ini 95 bytes
C:\Documents and Settings\Smokey\Application Data\Microsoft\Office\Recent\DrWeb.LNK 265 bytes
C:\Documents and Settings\Smokey\Application Data\Microsoft\Office\Recent\DrWeb2.LNK 270 bytes
C:\Documents and Settings\Smokey\Application Data\Microsoft\Office\Recent\DrWeb2a.LNK 273 bytes
C:\Documents and Settings\Smokey\Application Data\Microsoft\Office\Recent\index.dat 91 bytes
C:\Documents and Settings\Smokey\Application Data\Microsoft\Office\Recent\TRAVELDRIVE (J).LNK 190 bytes
C:\Documents and Settings\Smokey\Application Data\Google\Local Search History\google%2Eweb.w 90 bytes
C:\Documents and Settings\Smokey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\vmchecker.class-7ac16f10-16036e53.class 5.30KB
C:\Documents and Settings\Smokey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\vmchecker.class-7ac16f10-16036e53.idx 295 bytes
C:\Documents and Settings\Smokey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\hcImpl.jar-50174dc1-77f1a6d4.idx 41.44KB
C:\Documents and Settings\Smokey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\hcImpl.jar-50174dc1-77f1a6d4.zip 0.88MB
C:\WINDOWS\Internet Logs\ZALog2008.08.05.txt 17.81KB
C:\Documents and Settings\Smokey\Application Data\Macromedia\Flash Player\#SharedObjects\FQH3Z3PC\twitter.com\flash\twitter_badge.swf\OdeoPodcastPlayerColors.sol 65 bytes
C:\Documents and Settings\Smokey\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#twitter.com\settings.sol 81 bytes
C:\Documents and Settings\Smokey\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 434 bytes
C:\Program Files\Common Files\Real\Update_OB\RealPlayer-log.txt 76.15KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080805-2045.log 965 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080805-2100.txt 3.37KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080805-2106.log 426 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080805-2141.log 193 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080805-2141.txt 2.07KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080805-2142.txt 1.77KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-0131.log 503 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-0155.txt 2.14KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-0306.log 426 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-0345.txt 2.07KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-1228.log 516 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-1259.txt 2.16KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-1408.log 426 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-1433.txt 2.07KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-1442.log 426 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080806-1520.txt 2.07KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080807-0954.log 193 bytes
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Checks.080807-1000.txt 1.77KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Fixes.080805-2102.txt 3.31KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Fixes.080805-2103.txt 3.31KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Fixes.080806-0302.txt 2.14KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Fixes.080806-0303.txt 2.14KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Fixes.080806-1301.txt 2.15KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Fixes.080806-1437.txt 2.07KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Fixes.080806-1534.txt 2.07KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Resident.log 8.21KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\Update downloads.log 1.17KB
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Statistics.ini 692 bytes
------------------------------------------------------------------------------------------

[evilfantasy]

Is that a CCleaner log

You can empty the Trend Micro quarantined files.

Go to C:\Documents and Settings\Smokey\DoctorWeb\Quarantine and delete the contents of what is in there.

Delete this entire Symantec folder. C:\Documents and Settings\All Users\Application Data\Symantec

Do you use IncrediMail?

If not then delete the installer folder. C:\Program Files\IncrediMail

Empty the recycle bin.

Delete temporary files

Go to:

• Start
• Run
• type: CLEANMGR.EXE
  
• Press Enter.

When prompted select the C: drive and click OK.
Check the boxes for:

• Temporary Internet Files
• Downloaded Program Files
• Recycle Bin
• Temporary Files

.
Click OK or Enter

----------

Now you are clear of malware. Everything still running OK?

[Kryptonite]

Hopefully this is winding down.

In the list of things that could be cleaned up
 Dowloaded Programs has zero KB
Temp INt has 2631KB
Recycle bin has 71,746 kb
Temp has Zero
but one you didn't mention "Office steup files" has 196,114 KB
Will wait to hear what your advice is about the Office folder

Don't want that mail program that you mentioned, it's not in the add remove folder. There's quite a few things on here that i do not want including some empty folders in the root directory.

What's the story on deleting directly from the root directory? Does that confus the registry? How do i get those programs out?

The only thing left that spybot finds is that wildtangent " 3 PUPS " thing and it must be associated with other things cause it don't want to go away. One of the programs that i downloaded but did not use is something called Perfect uninstaller. Suppose to uninstall anything and everything you want off of your computer and make sure that it doesn't cause problems once it's gone.
Some of thse programs are like a bullet lodged in a part of your body that would cause more damage getting it out than living with it....at least that's how it seems from past experiences taking a clean up too far.

[evilfantasy]

This will let me see what all needs to be done to get rid of all the trash.

Download to your desktop ISeeYouXP.exe by ShadowPuterDude
Next double-click on ISeeYouXP.exe, this should be on your desktop.
 
ISeeYouXP.exe will self-extract ISeeYouXP to C:\ISeeYouXP.
 
Open My Computer on the Desktop and navigate to C:\ISeeYouXP and locate:
ISeeYouXP.bat
           
Double-click ISeeYouXP.bat to run the script.
 
Post the following logs
ISeeYouXP

[Kryptonite]

EF,

When i click on the link you've provided the download screen comes up but there is no "save" feature. In fact the only option is "cancel"

i copied and pasted the link exactly as you have it into a search and very little came up and nothing with those words. i tried changing it to: I seeYOURXP.exe and also found nothing. Maybe i should try a search for PeterDude but might guess to come up with a *censored* site ( not personal Peter. HA! )

Been holding back on updates as you suggested however i'm wondering if a driver update on my video card might not make a difference in this monitor black out that happens every once and a while. It does seem as if it happens around the time that i get a Trend Micro warning from spybot. Before all of this clean up took place i would hear a clicking sound ( if i knew my window sounds by name i could tell you which one it is but i don't remember them )

Tempted to try that update but will wait until i hear back from you.

It might be of interest to note that this desktop now boots in less than a minute while my laptop takes several minutes to boot. Once this one become my official everyday home computer i'll begin reading the cures for a slow computer here.

[evilfantasy]

What happens if you right click the link and then choose Save or Save as?

[Kryptonite]

Tried your suggestion on my laptop which runs Avira as my antivirus program....got three warnings from Avira:
WORM/KillProc.C worm.       Avira recommended "DENY" which i did.

Avira has given a few false-positives in the past, so i don't know what's what?

There was another situation with the HP that is very curious; don't think it's a virus issue, however it just might be.
Put it in "hibernate" when i left the house around 6am ( first time for "hibernate" on the HP ) and also left it connected to the live modem.
Around 6:30 PM i went into the room to switch the modem over to the laptop so i could use that MagicJack program to make phone calls. The HP was on at the sign on screen.
Is there an On Alarm somewhere in the control panel or another place that i don't know about? Can a hibernating computer be awakened remotely?
Something turned it on...could a power dip or momentary pause trigger it to come back on?
Could it be a "bad thing" still embedded somewhere in a remote file?

Maybe i should have purchased a new cheapo computer with little more than an OS and plenty or RAM. Thoughts on using one of them ( a new cheapo PC ) simply for phone use?

Is this "SeeyouXP" the only program of it's kind to do what you are looking to see? If it is i'm sure we could find another site to download it.

[evilfantasy]

KillProc is part of ISeeYouXP so it's OK to allow it.

Something turned it on yes, not sure what. It's a common thing with some PC's. You just have to turn things off and on one at a time to find out which one is causing it.