Solve : Can someone pls take a look at my logs??

1.	Solve : Can someone pls take a look at my logs??
Answer» Pls HELP me with my logs. Sorry to post the logs here as the uploader is full. Thanks! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:19:14 PM, on 10/10/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows DEFENDER\MSASCui.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Windows\WindowsMobile\wmdc.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE C:\Program Files\Internet Explorer\IEUser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\sniper.exe C:\Windows\system32\DllHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.sg.acer.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.sg.acer.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JR1916~1.0_0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JR1916~1.0_0\bin\ssv.dll O9 - Extra button: C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra 'Tools' menuitem: C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O13 - Gopher Prefix: O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217833594480&h=e06fac53bf269468d0a9679bd0173143/&filename=jinstall-6u7-windows-i586-jc.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: eNetHook.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Agere MODEM Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- End of file - 8416 bytesMalwarebytes' Anti-Malware 1.28 Database version: 1248 Windows 6.0.6001 Service Pack 1 10/10/2008 11:13:36 AM mbam-log-2008-10-10 (11-13-36).txt Scan type: Quick Scan Objects scanned: 44002 Time elapsed: 13 minute(s), 39 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 20 Registry Values Infected: 1 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gdaki0fw1s (Trojan.FakeAlert.H) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: C:\ProgramData\ydwzazwh\sbelqlaz.exe (Trojan.FakeAlert.H) -> Delete on reboot. C:\Users\Pacific Oil\Start Menu\Cheap Pharmacy Online.url (Rogue.Link) -> Quarantined and deleted successfully.SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 10/09/2008 at 09:14 PM Application Version : 4.21.1004 Core Rules Database Version : 3592 Trace Rules Database Version: 1579 Scan type : Complete Scan Total Scan Time : 09:29:13 Memory items scanned : 675 Memory threats detected : 1 Registry items scanned : 7411 Registry threats detected : 12 File items scanned : 571961 File threats detected : 188 Trojan.Dropper/Gen C:\PROGRAMDATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\MONAPLWIN\EZYBKVWL.EXE [monaplwin] C:\PROGRAMDATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\DOCUMENTS AND SETTINGS\ALL USERS\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\PROGRAMDATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE C:\USERS\ALL USERS\MONAPLWIN\EZYBKVWL.EXE C:\Windows\Prefetch\EZYBKVWL.EXE-DB54D010.pf Unclassified.Unknown Origin HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Classes\CLSID\{0656A137-B161-CADD-9777-E37A75727E78} HKCR\CLSID\{0656A137-B161-CADD-9777-E37A75727E78} Adware.Tracking Cookie C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected]Continuation to SuperAntiSpyware logs..... [1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Cookies\[email protected][2].txt C:\Documents and Settings\Pacific Oil\Cookies\[email protected][1].txt C:\Documents and Settings\Pacific Oil\Cookies\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][2].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt C:\Users\Pacific Oil\Cookies\[email protected][2].txt C:\Users\Pacific Oil\Cookies\[email protected][1].txt C:\Users\Pacific Oil\Cookies\[email protected][1].txt Adware.Casino Games (Golden Palace Casino) HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Golden Palace Casino PT Trojan.DNSChanger-Codec HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\uninstall Rogue.PC-Cleaner HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\dpcproxy HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\fwbd HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\HolLol HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Inet Delivery HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Invictus HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\mwc HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#SystemCheck2 [ e ] Rogue.TotalSecure2009 C:\Windows\system32\c.ico C:\Windows\system32\m.ico C:\Windows\system32\s.ico C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Start Menu\Search Online.url C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Start Menu\VIP Casino.url C:\Users\Pacific Oil\Start Menu\Search Online.url C:\Users\Pacific Oil\Start Menu\VIP Casino.urlLook through the logs at what was removed. Take note and remember to stop downloading whatever it is that is getting you infected like this. The HijackThis log looks OK. Are you having any problems still?Thanks for your COMMENT. So far it working fine. I don't even know why, when and what I've downloaded either. So is there anything I should remove from those logs? Quote from: evilfantasy on October 09, 2008, 11:31:56 PM The HijackThis log looks OK. Go HERE to see how to Delete the old infected Restore Points and create a new clean one. ---------- Use the Secunia Software Inspector to check for out of date software. Click Start Now Check the box next to Enable thorough system inspection. Click Start Allow the scan to finish and scroll down to see if any updates are needed. Update anything listed. . ---------- Go to Microsoft Windows Update and get all critical updates. ---------- Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC. Concerned about Browser Security? Consider using Mozilla Firefox 3.0 with Adblock Plus and NoScript To prevent unknown applications from being installed on your computer install WinPatrol 2008 * Using Winpatrol to protect your computer from malicious software I suggest using SiteAdvisor. SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites. SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox. * Using SpywareBlaster to protect your computer from Spyware and Malware * If you don't know what ActiveX controls are, see here Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future. Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Answer»

Pls HELP me with my logs. Sorry to post the logs here as the uploader is full. Thanks!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:19:14 PM, on 10/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows DEFENDER\MSASCui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.sg.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.sg.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JR1916~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JR1916~1.0_0\bin\ssv.dll
O9 - Extra button: C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217833594480&h=e06fac53bf269468d0a9679bd0173143/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: eNetHook.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Agere MODEM Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

--
End of file - 8416 bytesMalwarebytes' Anti-Malware 1.28
Database version: 1248
Windows 6.0.6001 Service Pack 1

10/10/2008 11:13:36 AM
mbam-log-2008-10-10 (11-13-36).txt

Scan type: Quick Scan
Objects scanned: 44002
Time elapsed: 13 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 20
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gdaki0fw1s (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\ProgramData\ydwzazwh\sbelqlaz.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\Users\Pacific Oil\Start Menu\Cheap Pharmacy Online.url (Rogue.Link) -> Quarantined and deleted successfully.SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/09/2008 at 09:14 PM

Application Version : 4.21.1004

Core Rules Database Version : 3592
Trace Rules Database Version: 1579

Scan type : Complete Scan
Total Scan Time : 09:29:13

Memory items scanned : 675
Memory threats detected : 1
Registry items scanned : 7411
Registry threats detected : 12
File items scanned : 571961
File threats detected : 188

Trojan.Dropper/Gen
   C:\PROGRAMDATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\MONAPLWIN\EZYBKVWL.EXE
   [monaplwin] C:\PROGRAMDATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\DOCUMENTS AND SETTINGS\ALL USERS\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\PROGRAMDATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\APPLICATION DATA\MONAPLWIN\EZYBKVWL.EXE
   C:\USERS\ALL USERS\MONAPLWIN\EZYBKVWL.EXE
   C:\Windows\Prefetch\EZYBKVWL.EXE-DB54D010.pf

Unclassified.Unknown Origin
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Classes\CLSID\{0656A137-B161-CADD-9777-E37A75727E78}
   HKCR\CLSID\{0656A137-B161-CADD-9777-E37A75727E78}

Adware.Tracking Cookie
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected]Continuation to SuperAntiSpyware logs.....

[1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Cookies\[email protected][2].txt
   C:\Documents and Settings\Pacific Oil\Cookies\[email protected][1].txt
   C:\Documents and Settings\Pacific Oil\Cookies\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Pacific Oil\Application Data\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\Low\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\[email protected][2].txt
   C:\Users\Pacific Oil\Cookies\[email protected][1].txt
   C:\Users\Pacific Oil\Cookies\[email protected][1].txt

Adware.Casino Games (Golden Palace Casino)
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Golden Palace Casino PT

Trojan.DNSChanger-Codec
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\uninstall

Rogue.PC-Cleaner
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\dpcproxy
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\fwbd
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\HolLol
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Inet Delivery
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Invictus
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\mwc
   HKU\S-1-5-21-2343131515-2399391026-3917823738-1000\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#SystemCheck2 [ e ]

Rogue.TotalSecure2009
   C:\Windows\system32\c.ico
   C:\Windows\system32\m.ico
   C:\Windows\system32\s.ico
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Start Menu\Search Online.url
   C:\Users\Pacific Oil\AppData\Roaming\Microsoft\Windows\Start Menu\VIP Casino.url
   C:\Users\Pacific Oil\Start Menu\Search Online.url
   C:\Users\Pacific Oil\Start Menu\VIP Casino.urlLook through the logs at what was removed. Take note and remember to stop downloading whatever it is that is getting you infected like this.

The HijackThis log looks OK. Are you having any problems still?Thanks for your COMMENT. So far it working fine. I don't even know why, when and what I've downloaded either. So is there anything I should remove from those logs?

Quote from: evilfantasy on October 09, 2008, 11:31:56 PM

The HijackThis log looks OK.

Go HERE to see how to Delete the old infected Restore Points and create a new clean one.

----------

Use the Secunia Software Inspector to check for out of date software.

Click Start Now
Check the box next to Enable thorough system inspection.
Click Start
Allow the scan to finish and scroll down to see if any updates are needed.
Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

Concerned about Browser Security? Consider using Mozilla Firefox 3.0 with Adblock Plus and NoScript

To prevent unknown applications from being installed on your computer install WinPatrol 2008
* Using Winpatrol to protect your computer from malicious software

I suggest using SiteAdvisor. SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Solve : Can someone pls take a look at my logs??

Discussion

No Comment Found

Related InterviewSolutions

Reply to Comment