trojan.vundo!gen P

[madness]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:28:44 PM, on 9/7/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SnapfishMediaDetector] C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Snapfish Media Detector.lnk = C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Doyles Room Poker - {725E77D3-B919-4eef-8EEE-D09DE618B6C1} - C:\Microgaming\Poker\DoylesRoomMPP\MPPoker.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4129B5DC-99F9-495A-8760-E0646DEAD679}: NameServer = 192.168.1.1
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11532 bytes

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, September 7, 2008
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, September 07, 2008 16:13:46
Records in database: 1200548
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Files scanned: 197026
Threat name: 8
Infected objects: 78
Suspicious objects: 0
Duration of the scan: 03:00:20


File name / Threat name / Threats count
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[1] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[2] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[3] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\kb671231[1] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8RRLEP1E\cntr[2] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8RRLEP1E\kb671231[1] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ERJ8V88\kb767887[2] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\cntr[1] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\cntr[2] Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\kb5432[1] Infected: Backdoor.Win32.Frauder.bu 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\kbg04311[1] Infected: Trojan-Downloader.Win32.Small.acrl 1
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OT0Y01VO\33[1].htm Infected: Trojan-Downloader.JS.Iframe.ua 1
C:\Users\Random\AppData\Local\Temp\.tt2414.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qt 1
C:\Users\Random\AppData\Local\Temp\.tt3160.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt46EE.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt484E.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt4886.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt4A08.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qt 1
C:\Users\Random\AppData\Local\Temp\.tt4A83.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt4C74.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt4DE8.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt4E8B.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt5090.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt5276.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt531C.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt5353.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt549B.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt5501.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt55F9.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt572F.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt58FD.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt5D6F.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.tt7775.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qt 1
C:\Users\Random\AppData\Local\Temp\.ttB05D.tmp Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\.ttC381.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttCA1B.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qt 1
C:\Users\Random\AppData\Local\Temp\.ttCA3F.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttCB74.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttCF07.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttCF47.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD183.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qt 1
C:\Users\Random\AppData\Local\Temp\.ttD1F0.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD220.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD2C3.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD429.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD459.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD4BB.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD4D8.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD588.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttD9B4.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttDC51.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\.ttE002.tmp Infected: not-a-virus:FraudTool.Win32.XPAntivirus.qu 1
C:\Users\Random\AppData\Local\Temp\baugymci.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\dvstvbio.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\dvuypbty.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\epspaqrp.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\estjqkuq.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\etxufpoi.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\fccbYpMg.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\gevrxfsy.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\ijpcbsow.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\jfnmwnqh.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\khfETnkL.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\nourydvs.exe Infected: Trojan-Downloader.Win32.Small.acrl 1
C:\Users\Random\AppData\Local\Temp\oppspxhx.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\ovnjohle.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\qjjfpsjx.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\rqRHxyxW.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\sjiqmscw.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\ssqPiGyW.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\uspaocvr.exe Infected: Backdoor.Win32.Frauder.bu 1
C:\Users\Random\AppData\Local\Temp\vbibvrne.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ddy 1
C:\Users\Random\AppData\Local\Temp\vwtulgmt.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\wcfcaugv.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ddy 1
C:\Users\Random\AppData\Local\Temp\xxyaaxUl.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\ybjibhvw.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\AppData\Local\Temp\yvcisxxp.dll Infected: Trojan.Win32.Monder.gen 1
C:\Users\Random\index.exe Infected: Trojan.Win32.VB.exj 1

The selected area was scanned.

[Shaba]

Please download ATF Cleaner by Atribune and save
it to desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit to close ATF-Cleaner.

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  Code: Select all

  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[1] 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[2] 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[3] I
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\kb671231[1]
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8RRLEP1E\cntr[2] 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8RRLEP1E\kb671231[1] 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ERJ8V88\kb767887[2] 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\cntr[1] Infected: 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\cntr[2] Infected: 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\kb5432[1] 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\kbg04311[1] 
  C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OT0Y01VO\33[1].htm 
  C:\Users\Random\AppData\Local\Temp\.tt2414.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt3160.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt46EE.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt484E.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt4886.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt4A08.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt4A83.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt4C74.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt4DE8.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt4E8B.tmp
  C:\Users\Random\AppData\Local\Temp\.tt5090.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt5276.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt531C.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt5353.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt549B.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt5501.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt55F9.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt572F.tmp
  C:\Users\Random\AppData\Local\Temp\.tt58FD.tmp 
  C:\Users\Random\AppData\Local\Temp\.tt5D6F.tmp
  C:\Users\Random\AppData\Local\Temp\.tt7775.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttB05D.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttC381.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttCA1B.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttCA3F.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttCB74.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttCF07.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttCF47.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD183.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD1F0.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD220.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD2C3.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD429.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD459.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD4BB.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD4D8.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD588.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttD9B4.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttDC51.tmp 
  C:\Users\Random\AppData\Local\Temp\.ttE002.tmp 
  C:\Users\Random\AppData\Local\Temp\baugymci.dll 
  C:\Users\Random\AppData\Local\Temp\dvstvbio.dll
  C:\Users\Random\AppData\Local\Temp\dvuypbty.dll 
  C:\Users\Random\AppData\Local\Temp\epspaqrp.dll 
  C:\Users\Random\AppData\Local\Temp\estjqkuq.dll 
  C:\Users\Random\AppData\Local\Temp\etxufpoi.dll
  C:\Users\Random\AppData\Local\Temp\fccbYpMg.dll 
  C:\Users\Random\AppData\Local\Temp\gevrxfsy.dll 
  C:\Users\Random\AppData\Local\Temp\ijpcbsow.dll 
  C:\Users\Random\AppData\Local\Temp\jfnmwnqh.dll 
  C:\Users\Random\AppData\Local\Temp\khfETnkL.dll 
  C:\Users\Random\AppData\Local\Temp\nourydvs.exe
  C:\Users\Random\AppData\Local\Temp\oppspxhx.dll 
  C:\Users\Random\AppData\Local\Temp\ovnjohle.dll 
  C:\Users\Random\AppData\Local\Temp\qjjfpsjx.dll 
  C:\Users\Random\AppData\Local\Temp\rqRHxyxW.dll 
  C:\Users\Random\AppData\Local\Temp\sjiqmscw.dll 
  C:\Users\Random\AppData\Local\Temp\ssqPiGyW.dll 
  C:\Users\Random\AppData\Local\Temp\uspaocvr.exe
  C:\Users\Random\AppData\Local\Temp\vbibvrne.dll 
  C:\Users\Random\AppData\Local\Temp\vwtulgmt.dll 
  C:\Users\Random\AppData\Local\Temp\wcfcaugv.dll 
  C:\Users\Random\AppData\Local\Temp\xxyaaxUl.dll 
  C:\Users\Random\AppData\Local\Temp\ybjibhvw.dll 
  C:\Users\Random\AppData\Local\Temp\yvcisxxp.dll 
  C:\Users\Random\index.exe
  

  
  
• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

[madness]

< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[1] >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[1] not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[2] >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[2] not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[3] I >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\cntr[3] I not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\kb671231[1] >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3X28MNEU\kb671231[1] not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8RRLEP1E\cntr[2] >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8RRLEP1E\cntr[2] not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8RRLEP1E\kb671231[1] >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8RRLEP1E\kb671231[1] not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ERJ8V88\kb767887[2] >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ERJ8V88\kb767887[2] not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\cntr[1] Infected: >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\cntr[1] Infected: not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\cntr[2] Infected: >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\cntr[2] Infected: not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\kb5432[1] >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\kb5432[1] not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\kbg04311[1] >
File/Folder C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4W7S2UJ\kbg04311[1] not found.
< C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OT0Y01VO\33[1].htm >
C:\Users\Random\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OT0Y01VO\33[1].htm moved successfully.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt2414.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt3160.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt46EE.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt484E.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt4886.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt4A08.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt4A83.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt4C74.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt4DE8.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt4E8B.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt5090.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt5276.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt531C.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt5353.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt549B.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt5501.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt55F9.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt572F.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt58FD.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt5D6F.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.tt7775.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttB05D.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttC381.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttCA1B.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttCA3F.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttCB74.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttCF07.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttCF47.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD183.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD1F0.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD220.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD2C3.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD429.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD459.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD4BB.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD4D8.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD588.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttD9B4.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttDC51.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\.ttE002.tmp not found.
File/Folder C:\Users\Random\AppData\Local\Temp\baugymci.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\dvstvbio.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\dvuypbty.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\epspaqrp.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\estjqkuq.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\etxufpoi.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\fccbYpMg.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\gevrxfsy.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\ijpcbsow.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\jfnmwnqh.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\khfETnkL.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\nourydvs.exe not found.
File/Folder C:\Users\Random\AppData\Local\Temp\oppspxhx.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\ovnjohle.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\qjjfpsjx.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\rqRHxyxW.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\sjiqmscw.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\ssqPiGyW.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\uspaocvr.exe not found.
File/Folder C:\Users\Random\AppData\Local\Temp\vbibvrne.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\vwtulgmt.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\wcfcaugv.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\xxyaaxUl.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\ybjibhvw.dll not found.
File/Folder C:\Users\Random\AppData\Local\Temp\yvcisxxp.dll not found.
C:\Users\Random\index.exe moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09082008_073146

[Shaba]

That looks good

Still problems?

[madness]

i don't think so. running a little slower than usual but that's OK. thanks a lot man.

[Shaba]

See here and post back if it helped for slowness

[madness]

every once in a while the CPU will start clicking and it will start to operate really slowly then goes back to normal for a little bit.

[Shaba]

Did you try those suggestions in my link?

[madness]

yes they've worked pretty well but ever since i got that virus the tower has been making a clicking noise. it seems to be doing fine right now so maybe it will just go away on its own.

[Shaba]

OK, have you opened case and checked that fan spins correctly and that there is not much dust?

[madness]

i just opened it up and cleaned out all the dust. so far no clicking. again much thanks.

[madness]

clicking is back actually guess ill just deal with it.

[Shaba]

If you feel that you need help with that, I can re-direct you to some windows forum

[madness]

that would be nice. i was googling it and im getting the feeling my hard drive is messed up

[Shaba]

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

I recommend this place.

You can delete RSIT.

Next we remove all used tools.

Please download OTCleanIt and save it to desktop.

• Double-click OTCleanIt.exe.
• Click the CleanUp! button.
• Select Yes when the "Begin cleanup Process?" prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

• Disable and Enable System Restore. - If you are using Windows Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
  
  You can find instructions on how to enable and re-enable system restore here:
  
  Windows Vista System Restore Guide

Re-enable system restore with instructions from tutorial above

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
  
• Change the Download unsigned ActiveX controls to Disable
  
• Change the Initialize and script ActiveX controls not marked as safe to Disable
  
• Change the Installation of desktop items to Prompt
  
• Change the Launching programs and files in an IFRAME to Prompt
  
• Change the Navigate sub-frames across different domains to Prompt
  
• When all these settings have been made, click on the OK button.
  
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
• Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
  totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
  
  Malwarebytes' Anti-Malware Setup Guide
  
  Malwarebytes' Anti-Malware Scanning Guide
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!