please help.....im getting weird pop-ups

[sblendo5]

the computer seems to be running good, no more pop-ups, but IE crashes rarely.

the scan took almost three hours to complete, is that normal?

kapersky log

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Tuesday, November 17, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, November 17, 2009 22:16:16
Records in database: 3230603
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Objects scanned: 88787
Threats found: 10
Infected objects found: 15
Suspicious objects found: 0
Scan duration: 02:47:03


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\barijatu.dll.tmp.vir Infected: Packed.Win32.Katusha.g 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\buhuzopo.dll.vir Infected: Trojan.Win32.Monderb.bgon 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\famujize.dll.tmp.vir Infected: Packed.Win32.Katusha.g 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\febefiya.dll.vir Infected: Trojan.Win32.Monder.cusy 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\jibogosu.dll.vir Infected: Trojan.Win32.Monderb.bgos 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\lefopase.dll.vir Infected: Trojan.Win32.Monder.cuql 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\pasugusa.dll.vir Infected: Trojan.Win32.Monderb.bgpi 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\pemejilo.dll.vir Infected: Packed.Win32.Katusha.g 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\puyepidu.dll.vir Infected: Trojan.Win32.Monder.curh 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\rogiwezu.dll.vir Infected: Trojan.Win32.Monder.cust 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\sirifiwi.dll.vir Infected: Packed.Win32.Katusha.g 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\tihugole.dll.vir Infected: Trojan.Win32.Monder.cutb 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\vuboduje.dll.vir Infected: Trojan.Win32.Monder.cuum 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\wepejapu.dll.vir Infected: Packed.Win32.Katusha.g 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\zokufevi.dll.tmp.vir Infected: Packed.Win32.Katusha.g 1

Selected area has been scanned.

[km2357]

the computer seems to be running good, no more pop-ups, but IE crashes rarely.

If IE crashes more often than usual in the future, you can try uninstalling and reinstalling IE 7. Or you can upgrade to IE 8. Or try another browser such as FireFox or Opera.

the scan took almost three hours to complete, is that normal?

That's normal. Kaspersky scans usually take 2-3 hours to complete.

Kaspersky found files in the Qoobox directory which is where ComboFix keeps its quarantined files. I'll show you how to remove those in this post.

Since you report no more problems, you are good to go.

You can delete the following off of your computer:

DDS.scr
The two DDS Logs
GMER.zip
GMER.exe
The GMER Log

To remove ComboFix, do the following:

Go to Start > Run - type in ComboFix /Uninstall & click OK

Empty your Recycle Bin.

Please take the time to read my All Clean Post.

Please follow these simple steps in order to keep your computer clean and secure:

This is a good time to clear your existing system restore points and establish a new clean restore point

• Go to Start > All Programs > Accessories > System Tools > System Restore
• Select Create a restore point, and Ok it.
• Next, go to Start > Run and type in cleanmgr
• Make sure the C:\ drive is selected and click OK. If your computer's Hard Drive is not located on C:, change it to the correct drive letter then click OK.
• Select the More options tab
• Choose the option to clean up system restore and OK it.
• This will remove all restore points except the new one you just created.

.

Clearing your restore points is not something you should do on a regular basis. Normally, this process only needs to be done after clearing out an infestation of malware.


Make your Internet Explorer more secure This can be done by following these simple instructions:

1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
   
   • Change the Download signed ActiveX controls to Prompt
   • Change the Download unsigned ActiveX controls to Disable
   • Change the Initialize and script ActiveX controls not marked as safe to Disable
   • Change the Installation of desktop items to Prompt
   • Change the Launching programs and files in an IFRAME to Prompt
   • Change the Navigate sub frames across different domains to Prompt
5. When all these settings have been made, click on the OK button.
6. If it asks you if you want to save the settings, press the Yes button.
7. Next press the Apply button and then the OK to exit the Internet Properties page.

Set correct settings for files that should be hidden in Windows XP

• Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
• Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
• If unchecked please checkHide protected operating system files (Recommended)
• If necessary check "Display content of system folders"
• If necessary Uncheck Hide file extensions for known file types.
• Click OK

• Use An Antivirus Software and Keep It Updated - It is very important that your computer has an antivirus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a day. If you do not update your antivirus software, then it will not be able to catch any of the new variants that may come out.
• Visit Microsoft's Update Site Frequently It is important that you visit Microsoft Updates regularly. This will ensure your computer has the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
• Install SpywareBlaster SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. An article on anti-malware products with links for this program and others can be found here:
  Computer Safety on line Anti Malware
• Use the hosts file: Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate web pages. We can customize a hosts file so that it blocks certain web pages. However, it can slow down certain computers. This is why using a hosts file is optional. Download mvps hosts file Make sure you read the instructions on how to install the hosts file. There is a good tutorial HERE If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
  
  1. Click the start button on the task bar at the bottom of your screen
  2. Click run
  3. In the dialog box, type services.msc
  4. hit enter, then locate dns client
  5. Highlight it, then doubleclick it.
  6. On the dropdown box, change the setting from automatic to manual.
  7. Click ok..
• Use an alternative instant messenger program.Trillian and Miranda IM These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
• Please read Tony Klein's excellent article: How I got Infected in the First Place
• Please read Understanding Spyware, Browser Hijackers, and Dialers
• Please read Simple and easy ways to keep your computer safe and secure on the Internet
• If you are using Internet Explorer, please consider using an alternate browser: Mozilla's Firefox or
  Opera.
  If you decide to use either FireFox or Opera, it is very important that you keep them up to date and check frequently for updates of the browser of your choice.
• Update all these programs regularly Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
• If your computer was infected by a website, a program, IM, MSN, or p2p, check this site because it is Time To Fight Back.

Follow these steps and your potential for being infected again will reduce dramatically.

Here's a good website to read about Malware prevention:

http://users.telenet.be/bluepatchy/miek ... ntion.html

If your computer is running slow, click here for instructions on how to help speed up your computer.

Good luck!

Please reply one last time so that I know you have read my post and this thread can be closed.

[sblendo5]

i did not do this last step yet, but you said the post will show me how to remove the quarantined files from combo fix, i don't see where it is. are they deleted by just simply uninstalling combofix?

[km2357]

i did not do this last step yet, but you said the post will show me how to remove the quarantined files from combo fix, i don't see where it is. are they deleted by just simply uninstalling combofix?

That's correct.

[sblendo5]

i got another pop-up yesterday saying my computer was infected with viruses....now what, i haven't had a chance to do the last cleaning step you gave me yet.

[km2357]

Since you got a new popup, let's hold off on the "All-Clean" post/step for now.

First, have you installed a new Anti-Virus yet to take the place of McAfee? If you haven't yet, please do so immediately.

You can use this link as reference for downloading one of two free AV's:

viewtopic.php?p=484720#p484720

Once you've downloaded and installed either Avira or Avast, I'd like for you to do the following:

1. Rerun DDS.
2. Run Malwarebytes' Anti-Malware

• Launch Malwarebytes' Anti-Malware.
• Before running a scan, click the Update tab, next click Check for Updates to download any updates, if available.
• Next click the Scanner tab and select Perform Quick Scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location.
• You can also access the log by doing the following:
  
• Click on the Malwarebytes' Anti-Malware icon to launch the program.
• Click on the Logs tab.
• Click on the log at the bottom of those listed to highlight it.
• Click Open.

3. Run a scan with your new AV (be sure that it is updated first)


In your next post/reply, I need to see the following:

1. A fresh DDS Log
2. The MalwareBytes' Log
3. The Log from your new Anti-Virus scan (if the scan doesn't find anything, let me know that as well)

[sblendo5]

i installed avg scan on this computer. i got a pop-up that looks like the screen when you click on my computer, and under each drive it listed infections and they were blinking red. when i closed that window out i got another pop-up that looks like it was from windows saying my computer is severly infected.

dds log


DDS (Ver_09-10-26.01) - NTFSx86
Run by Frank & Liz at 13:03:57.10 on Sun 11/22/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.287 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Southwest Airlines\Ding\Ding.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Frank & Liz\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/webhp
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&cli ... channel=us
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\frank&~1\startm~1\programs\startup\ding!.lnk - c:\program files\southwest airlines\ding\Ding.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hppsc2~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpobnz08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: RemindU - file://c:\documents and settings\frank & liz\application data\upromise__remindu\uprot\uproC5.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: musicmatch.com\online
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shoc ... tor/sw.cab
DPF: {26B2A5DA-BFD6-422F-A89A-28A54C74B12B} - hxxp://www.costcophotocenter.com/upload ... ontrol.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www.costcophotocenter.com/CostcoActivia.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} - hxxp://web1.shutterfly.com/downloads/Uploader.cab
DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} - hxxp://images3.pnimedia.com/ProductAsse ... ontrol.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/sh ... wflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://www.costcophotocenter.com/upload ... ontrol.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-11-17 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-17 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-11-17 285392]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-9-27 133104]

=============== Created Last 30 ================

2009-11-17 22:18:36 0 d--h--w- C:\$AVG
2009-11-17 22:18:25 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-17 22:18:25 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-17 22:18:18 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-17 22:18:09 0 d-----w- c:\windows\system32\drivers\Avg
2009-11-17 22:17:51 0 d-----w- c:\program files\AVG
2009-11-17 22:17:48 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9
2009-11-15 19:48:37 0 d-----w- c:\docume~1\frank&~1\applic~1\Malwarebytes
2009-11-15 19:48:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-15 19:48:31 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-15 19:48:31 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-15 19:48:31 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-11-15 19:36:51 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-11 21:43:25 0 d-----w- C:\ComboFix
2009-11-09 23:35:35 0 d-sha-r- C:\cmdcons
2009-11-09 23:32:42 98816 ----a-w- c:\windows\sed.exe
2009-11-09 23:32:42 77312 ----a-w- c:\windows\MBR.exe
2009-11-09 23:32:42 267264 ----a-w- c:\windows\PEV.exe
2009-11-09 23:32:42 161792 ----a-w- c:\windows\SWREG.exe
2009-11-03 22:15:49 0 d-----w- c:\program files\Trend Micro
2009-10-25 17:20:27 0 d-----w- c:\windows\system32\wbem\Repository

==================== Find3M ====================

2009-11-11 21:29:23 3350 -csha-w- c:\windows\system32\KGyGaAvL.sys
2009-10-21 04:08:54 3598336 ----a-w- c:\windows\system32\dllcache\mshtml.dll
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 14:18:39 136192 ------w- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 21:03:36 58880 ------w- c:\windows\system32\dllcache\msasn1.dll
2009-08-28 10:28:59 70656 ------w- c:\windows\system32\dllcache\ie4uinit.exe
2009-08-28 10:28:59 13824 ------w- c:\windows\system32\dllcache\ieudinit.exe
2009-08-27 05:18:44 634648 ------w- c:\windows\system32\dllcache\iexplore.exe
2009-08-27 05:18:41 161792 ------w- c:\windows\system32\dllcache\ieakui.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\dllcache\strmdll.dll
2008-09-27 15:25:37 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008092720080928\index.dat

============= FINISH: 13:04:36.01 ===============


malwarebytes log

Malwarebytes' Anti-Malware 1.41
Database version: 3176
Windows 5.1.2600 Service Pack 3

11/22/2009 1:59:05 PM
mbam-log-2009-11-22 (13-58-55).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 201425
Time elapsed: 52 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 31

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\WINDOWS\system32\barijatu.dll.tmp.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\bihorugi.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\degejiba.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\difebebu.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dusatalo.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\famujize.dll.tmp.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\fareruta.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\febefiya.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\gavulowe.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\guromome.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jebufijo.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jibogosu.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kimapuge.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lefopase.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lugibifi.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\luvigaki.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\pemejilo.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\petolahu.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\popezaho.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\puyepidu.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\raferafo.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\rewikupe.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\rogiwezu.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\sirifiwi.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tifileze.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tihugole.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\vuboduje.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wepejapu.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\yayosiyi.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zetoyago.dll.vir (Trojan.Vundo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zokufevi.dll.tmp.vir (Trojan.Vundo) -> No action taken.


avg scan

Scan "Scan whole computer" was finished.
Warnings;"112";"112";"0"
Folders selected for scanning:;"Scan whole computer"
Scan started:;"Sunday, November 22, 2009, 2:03:24 PM"
Scan finished:;"Sunday, November 22, 2009, 2:53:41 PM (50 minute(s) 16 second(s))"
Total object scanned:;"333454"
User who launched the scan:;"Frank & Liz"

Warnings
File;"Infection";"Result"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@zedo[1].txt:\zedo.com.f462b69f;"Found Tracking cookie.Zedo";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@zedo[1].txt:\zedo.com.dd15d628;"Found Tracking cookie.Zedo";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@zedo[1].txt:\zedo.com.cef1c7af;"Found Tracking cookie.Zedo";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@zedo[1].txt:\zedo.com.c1dd09f2;"Found Tracking cookie.Zedo";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@zedo[1].txt:\zedo.com.a5b6a132;"Found Tracking cookie.Zedo";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@zedo[1].txt:\zedo.com.27f1639b;"Found Tracking cookie.Zedo";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@zedo[1].txt:\zedo.com.14a38114;"Found Tracking cookie.Zedo";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@zedo[1].txt;"Found Tracking cookie.Zedo";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@tribalfusion[3].txt:\tribalfusion.com.dcc03271;"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@tribalfusion[3].txt;"Found Tracking cookie.Tribalfusion";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@trafficmp[3].txt:\trafficmp.com.f3e5803e;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@trafficmp[3].txt:\trafficmp.com.e2e71e33;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@trafficmp[3].txt:\trafficmp.com.ae53b8b;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@trafficmp[3].txt:\trafficmp.com.a00e30b4;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@trafficmp[3].txt:\trafficmp.com.37644bdb;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@trafficmp[3].txt:\trafficmp.com.2550f224;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@trafficmp[3].txt;"Found Tracking cookie.Trafficmp";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@tacoda[1].txt:\tacoda.net.ed9c50d1;"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@tacoda[1].txt:\tacoda.net.c4fe2ebb;"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@tacoda[1].txt:\tacoda.net.5935e89;"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@tacoda[1].txt:\tacoda.net.4366831a;"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@tacoda[1].txt:\tacoda.net.27341d57;"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@tacoda[1].txt;"Found Tracking cookie.Tacoda";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@statse.webtrendslive[1].txt:\statse.webtrendslive.com.b4ca7df0;"Found Tracking cookie.Webtrendslive";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@statse.webtrendslive[1].txt;"Found Tracking cookie.Webtrendslive";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@serving-sys[1].txt:\serving-sys.com.c9034af6;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@serving-sys[1].txt:\serving-sys.com.6a1cf9e8;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@serving-sys[1].txt:\serving-sys.com.606c3d3b;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@serving-sys[1].txt:\serving-sys.com.4b416ef8;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@serving-sys[1].txt:\serving-sys.com.400f83f;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@serving-sys[1].txt:\serving-sys.com.255d6f2f;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@serving-sys[1].txt;"Found Tracking cookie.Serving-sys";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@revsci[3].txt:\revsci.net.f7ac007f;"Found Tracking cookie.Revsci";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@revsci[3].txt:\revsci.net.e9dbeb91;"Found Tracking cookie.Revsci";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@revsci[3].txt:\revsci.net.e1150a02;"Found Tracking cookie.Revsci";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@revsci[3].txt:\revsci.net.50e13b1b;"Found Tracking cookie.Revsci";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@revsci[3].txt:\revsci.net.44927ec;"Found Tracking cookie.Revsci";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@revsci[3].txt:\revsci.net.2df99d79;"Found Tracking cookie.Revsci";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@revsci[3].txt:\revsci.net.18a1d1b2;"Found Tracking cookie.Revsci";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@revsci[3].txt;"Found Tracking cookie.Revsci";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@realmedia[2].txt:\realmedia.com.e14be39e;"Found Tracking cookie.Realmedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@realmedia[2].txt:\realmedia.com.855b46d;"Found Tracking cookie.Realmedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@realmedia[2].txt:\realmedia.com.125a868c;"Found Tracking cookie.Realmedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@realmedia[2].txt;"Found Tracking cookie.Realmedia";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@questionmarket[1].txt:\questionmarket.com.4dd5e426;"Found Tracking cookie.Questionmarket";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@questionmarket[1].txt:\questionmarket.com.3eb5a9f1;"Found Tracking cookie.Questionmarket";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@questionmarket[1].txt;"Found Tracking cookie.Questionmarket";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@pointroll[3].txt:\pointroll.com.f2d5a6f6;"Found Tracking cookie.Pointroll";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@pointroll[3].txt:\pointroll.com.72c0abc9;"Found Tracking cookie.Pointroll";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@pointroll[3].txt;"Found Tracking cookie.Pointroll";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@mediaplex[3].txt:\mediaplex.com.f652b123;"Found Tracking cookie.Mediaplex";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@mediaplex[3].txt:\mediaplex.com.dc30fb3c;"Found Tracking cookie.Mediaplex";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@mediaplex[3].txt;"Found Tracking cookie.Mediaplex";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@media.adrevolver[1].txt:\media.adrevolver.com.7fd89687;"Found Tracking cookie.Adrevolver";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@media.adrevolver[1].txt;"Found Tracking cookie.Adrevolver";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@fastclick[3].txt:\fastclick.net.94ca190b;"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@fastclick[3].txt:\fastclick.net.8a6435e9;"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@fastclick[3].txt:\fastclick.net.57e8da10;"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@fastclick[3].txt;"Found Tracking cookie.Fastclick";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@doubleclick[3].txt:\doubleclick.net.bf396750;"Found Tracking cookie.Doubleclick";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@doubleclick[3].txt;"Found Tracking cookie.Doubleclick";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@dealtime[2].txt:\dealtime.com.f53eaefc;"Found Tracking cookie.Dealtime";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@dealtime[2].txt:\dealtime.com.a164b0cd;"Found Tracking cookie.Dealtime";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@dealtime[2].txt:\dealtime.com.7da0edca;"Found Tracking cookie.Dealtime";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@dealtime[2].txt:\dealtime.com.712ccb33;"Found Tracking cookie.Dealtime";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@dealtime[2].txt:\dealtime.com.48a2428c;"Found Tracking cookie.Dealtime";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@dealtime[2].txt:\dealtime.com.2a6d70da;"Found Tracking cookie.Dealtime";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@dealtime[2].txt:\dealtime.com.17495ee5;"Found Tracking cookie.Dealtime";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@dealtime[2].txt;"Found Tracking cookie.Dealtime";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt:\casalemedia.com.fb62dd4b;"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt:\casalemedia.com.987e6b46;"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt:\casalemedia.com.8c65eddd;"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt:\casalemedia.com.80ad4799;"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt:\casalemedia.com.650648e8;"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt:\casalemedia.com.350339d4;"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt:\casalemedia.com.2d37ad26;"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt:\casalemedia.com.1773afc;"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@casalemedia[3].txt;"Found Tracking cookie.Casalemedia";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@bs.serving-sys[2].txt:\bs.serving-sys.com.5bf1f00f;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@bs.serving-sys[2].txt;"Found Tracking cookie.Serving-sys";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@atdmt[2].txt:\atdmt.com.b3e33b5f;"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@atdmt[2].txt:\atdmt.com.7247c262;"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@atdmt[2].txt;"Found Tracking cookie.Atdmt";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@advertising[1].txt:\advertising.com.f62113d5;"Found Tracking cookie.Advertising";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@advertising[1].txt:\advertising.com.b624fa46;"Found Tracking cookie.Advertising";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@advertising[1].txt:\advertising.com.525a5fb9;"Found Tracking cookie.Advertising";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@advertising[1].txt:\advertising.com.203aa218;"Found Tracking cookie.Advertising";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@advertising[1].txt:\advertising.com.1dfa2206;"Found Tracking cookie.Advertising";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@advertising[1].txt:\advertising.com.1820df7a;"Found Tracking cookie.Advertising";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@advertising[1].txt;"Found Tracking cookie.Advertising";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adrevolver[2].txt:\adrevolver.com.f6cfcad4;"Found Tracking cookie.Adrevolver";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adrevolver[2].txt:\adrevolver.com.9b9d670a;"Found Tracking cookie.Adrevolver";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adrevolver[2].txt;"Found Tracking cookie.Adrevolver";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adbrite[2].txt:\adbrite.com.d5e309c2;"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adbrite[2].txt:\adbrite.com.775ee79c;"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adbrite[2].txt:\adbrite.com.71beeff9;"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adbrite[2].txt:\adbrite.com.557c9f74;"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adbrite[2].txt:\adbrite.com.44f92a69;"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@adbrite[2].txt;"Found Tracking cookie.Adbrite";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@ad.yieldmanager[3].txt:\ad.yieldmanager.com.e626e6be;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@ad.yieldmanager[3].txt:\ad.yieldmanager.com.b68f2b7b;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@ad.yieldmanager[3].txt:\ad.yieldmanager.com.830b6f08;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@ad.yieldmanager[3].txt:\ad.yieldmanager.com.557bf2b0;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@ad.yieldmanager[3].txt:\ad.yieldmanager.com.539b0606;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@ad.yieldmanager[3].txt;"Found Tracking cookie.Yieldmanager";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@2o7[3].txt:\2o7.net.a314a373;"Found Tracking cookie.2o7";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@2o7[3].txt:\2o7.net.4209f81c;"Found Tracking cookie.2o7";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@2o7[3].txt:\2o7.net.2e368e64;"Found Tracking cookie.2o7";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@2o7[3].txt:\2o7.net.1a6a6c0d;"Found Tracking cookie.2o7";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@2o7[3].txt;"Found Tracking cookie.2o7";"Healed"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@247realmedia[1].txt:\247realmedia.com.855b46d;"Found Tracking cookie.247realmedia";"Moved to Virus Vault"
C:\Documents and Settings\Frank & Liz\Cookies\frank_&_liz@247realmedia[1].txt;"Found Tracking cookie.247realmedia";"Healed"

[km2357]

Looks like the only things AVG found were Tracking Cookies.

Malwarebytes' Anti-Malware 1.41
Database version: 3176

You need to update MalwareBytes'. The latest database version is in the 3210's. Please run MBAM again (do a Quick Scan this time, not a Full Scan) and post back the new MalwareBytes' Log in your next post/reply.

Also, let me know if you're still getting those popups you mentioned at the beginning of your last post.

[sblendo5]

new log

Malwarebytes' Anti-Malware 1.41
Database version: 3224
Windows 5.1.2600 Service Pack 3

11/24/2009 5:47:23 PM
mbam-log-2009-11-24 (17-47-23).txt

Scan type: Quick Scan
Objects scanned: 130435
Time elapsed: 16 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Frank & Liz\Local Settings\Temporary Internet Files\Content.IE5\H9GK9BDX\Alpha-Setupe3dad_2001-10[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Frank & Liz\Local Settings\Temporary Internet Files\Content.IE5\HPVWAL5K\Alpha-Setup5920_2001-10[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Frank & Liz\Local Settings\Temporary Internet Files\Content.IE5\HPVWAL5K\Alpha-Setupe728d9d_2001-10[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Frank & Liz\Local Settings\Temporary Internet Files\Content.IE5\L7YS9KWG\Alpha-Setup27ab1_2001-10[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Frank & Liz\Local Settings\Temporary Internet Files\Content.IE5\SC9S1HJX\Alpha-Setup9ec3_2001-10[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Frank & Liz\Local Settings\Temporary Internet Files\Content.IE5\UP4LTFN1\Alpha-Setupbe0_2001-10[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.

[km2357]

Do you recognize any of the files that MBAM deleted? Did you (or anyone using the computer) download any files that the words "Alpha Setup" in them recently?

Are you still getting popups?

[sblendo5]

to be honest with yuo this is my brother-in-laws computer i am trying to fix for him, so i am not always on it. he is not a computer person and doesn't always understand the question i am asking him.

he does not know where the alpha setup files came from, and he does not believe he has gotten any pop-ups since i did that last scan.

[km2357]

Good to hear that he hasn't gotten any more popups.

If the computer doesn't experience any more popups by Sunday, then go ahead and do the steps that you didn't do in the All Clean Post

Let me know when you've done those steps and we'll go ahead and close the thread. Also let me know if you get any more popups between now and Sunday.

[sblendo5]

we have not experienced any more pop-ups on the computer, i am going to do the clean-up process tomorrow afternoon. my brother-in-law keeps asing me what he had on his computer, can you tell me?

[km2357]

Good to hear that you're not experiencing any more popups.

What your brother-in-law's computer had is called Vundo, also known as Virtumonde. VirtuMonde is an adware program that downloads and displays popup advertisements.

You can read more about the infection at the following links:

http://www.symantec.com/security_respon ... 99&tabid=2
http://en.wikipedia.org/wiki/Vundo

Let me know when you've completed the clean up process.

[sblendo5]

im sorry i did not get back to you sooner, but i completed the clean-up process and it seems to be working fine...thanks so much