Hi

For the last couple of days my computer seems to be permantly accessing the internet, Live Messenger seems to be involved and Norton AV is reporting Trojans.

Norton AV Auto Protect reported the following, taken from NAV log.
Category: Virus alerts
Date,Feature,Virus Name,Action Taken,Item Type,Target,Suspicious Action,User Name,Computer Name,Details
19/08/2007 21:25:34,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
19/08/2007 21:25:34,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
19/08/2007 21:25:34,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\HEBCML01\onpen[1].txt
19/08/2007 21:25:34,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\HEBCML01\onpen[1].txt
19/08/2007 21:25:30,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
19/08/2007 21:25:30,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
19/08/2007 21:25:30,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\KLYNC1E3\onpen[1].txt
19/08/2007 21:25:30,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\KLYNC1E3\onpen[1].txt
19/08/2007 21:24:15,Auto-Protect,Trojan.Packed.13,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\9B.tmp
19/08/2007 21:24:15,Auto-Protect,Trojan.Packed.13,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\10CBDDGT\test[1].exe
19/08/2007 21:24:15,Auto-Protect,Trojan.Packed.13,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\10CBDDGT\test[1].exe
19/08/2007 21:02:21,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\10CBDDGT\onpen[1].txt
19/08/2007 21:02:21,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\10CBDDGT\onpen[1].txt
19/08/2007 21:02:21,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
19/08/2007 21:02:21,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 21:38:27,Auto-Protect,Downloader,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 21:38:27,Auto-Protect,Downloader,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\I534LS7U\onpen[1].txt
18/08/2007 21:38:25,Auto-Protect,Trojan.Packed.9,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\xrhua.exe
18/08/2007 21:38:25,Auto-Protect,Trojan.Packed.9,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\KLYNC1E3\tbzounxcv[1].htm
18/08/2007 21:38:08,Auto-Protect,Trojan.Packed.9,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\xrhua.exe
18/08/2007 21:38:08,Auto-Protect,Trojan.Packed.9,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\NXK1HXO5\tbzounxcv[1].htm
18/08/2007 19:01:47,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\7ZR1TCD5\onpen[1].txt
18/08/2007 19:01:47,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\7ZR1TCD5\onpen[1].txt
18/08/2007 19:01:47,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 19:01:47,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 18:32:30,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 18:32:30,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 18:32:30,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\09MRK1IN\onpen[1].txt
18/08/2007 18:32:30,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\09MRK1IN\onpen[1].txt
18/08/2007 17:36:21,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 17:36:21,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 17:36:21,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\09MRK1IN\onpen[1].txt
18/08/2007 17:36:21,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\09MRK1IN\onpen[1].txt
18/08/2007 17:19:33,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\10CBDDGT\onpen[1].txt
18/08/2007 17:19:33,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\10CBDDGT\onpen[1].txt
18/08/2007 17:19:33,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 17:19:33,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 17:19:27,Auto-Protect,Downloader,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 17:19:27,Auto-Protect,Downloader,Automatically deleted,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\09MRK1IN\onpen[1].txt
18/08/2007 16:52:44,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 16:52:44,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\ffmkn.exe
18/08/2007 16:52:44,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\I534LS7U\onpen[1].txt
18/08/2007 16:52:44,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,Charlie,KEENDELL,Source: C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\I534LS7U\onpen[1].txt

However when I do a scan with Norton's it dosn't find anything. These files are not there when I look in windows explorer (Hidden filed shown).


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1022, on 20/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA HE.EXE
C:\WINDOWS\tsnp2std.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/u...en/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Desksite CMA] C:\Program Files\desksite\bin\cma.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA HE.EXE /P30 "EPSON Stylus Photo R240 Series" /O6 "USB002" /M "Stylus Photo R240"
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DesktopWengerCluster] C:\Program Files\Desktop Wenger\skinkers.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/...gameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/bingame/pacz/def...andaonline.cab
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/instal...sinstaller.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/dialer/internazionale_ver10.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab34246.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://mia.bt.com/dana-cached/setup/JuniperSetup.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15029/CTPID.cab
O21 - SSODL: Version1 - {3CB3F71A-249F-4C89-B495-4C118789A6D0} - libweb.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O24 - Desktop Component 0: (no name) - http://www.runehq.com/images/skillguides/rawlobster.gif
O24 - Desktop Component 1: (no name) - http://runehq.com/image/itemsdb/abyssalwhip.gif
O24 - Desktop Component 2: (no name) - http://www.runescape.com/lang/en/aff...w1_800x600.jpg

--
End of file - 12133 bytes


Uninstall list
==========
Adobe Flash Player 9 ActiveX
Adobe Reader 6.0.1
AOL UK
ArcSoft VideoImpression 1.6FP
ArcSoft VideoImpression 2
Auctioneer AddOns
BBC Wallace and Gromit Fun Pack 2
BCM V.92 56K Modem
BT Broadband Help
Classic PhoneTools
Counter-Strike: Source
DA920EN
DAO
Dell Media Experience
Dell Picture Studio - Dell Image Expert
Dell Solution Center
Desperados - A Wild West adventure 1.0
Digimask LaunchPad2
Disney's Tarzan Action Game Demo
DVDSentry
EPSON Attach To Email
EPSON Easy Photo Print
EPSON File Manager
EPSON Printer Software
EPSON Scan Assistant
EPSON Web-To-Page
ESPR240 User's Guide
FinePixViewer Ver.3.1
FirstClass® Client
FUJIFILM USB Driver
glwjmgeb
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Human Body Explorer
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet
InterActual Player
Java 2 Runtime Environment, SE v1.4.2
LEGO Creator Harry Potter
LEGO Island 2
LEGO Racers 2
LEGO Stunt Rally
LiveReg (Symantec Corporation)
LiveUpdate 3.0 (Symantec Corporation)
Logitech iTouch Software
Logitech MouseWare 9.75
Macromedia Shockwave Player
Magic Online
Map Button (Windows Live Toolbar)
MetalGearSolid2 Substance
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works 7.0
Modem Helper
Norton AntiVirus 2003
Norton WMI Update
NVIDIA Display Driver
Paint Shop Pro 7
PC-Rail Simulations
PowerDVD
Puzzle Pirates
QuickTime
Rayman3
Reader Rabbit's Math Ages 6-9
RealArcade
RealPlayer
Rogue Spear
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Smart Menus (Windows Live Toolbar)
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
Sound Blaster Live!
Spybot - Search & Destroy 1.4
Star Wars 2 Screen Saver
Steam(TM)
Test For Success - English
Test For Success - Maths
Test For Success - Science
The Map Detectives
The Number Shop
thesimpsonsbusy.zip
Tiscali 10.0
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
USB2.0 PC Camera (SN9C201&202)
Viewpoint Media Player
Windows Defender Signatures
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinZip
World of Warcraft

You will need to be REBOOTING a number of times in the fix procedures. Accordingly, it is probably a good idea to print out the following directions or copy them to a text file on your desktop using NOTEPAD. Read these instructions carefully and feel free to ask if you're unsure about anything.

Java 2 Runtime Environment, SE v1.4.2

Your system has an outdated version(s) of Sun Java that could create serious security exposure issues for your PC.

Update your Java.

Older JAVA versions have vulnerabilities that malware can and are using to infect systems.

Please follow these steps to remove older version Java components.

• Close any programs you may have running, ESPECIALLY your web browser
• Click Start > Control Panel.
• Click Add/Remove Programs.
• Check any item with Java Runtime Environment (JRE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove all versions of Java.
• Reboot your computer once all Java components are removed.

Download the latest version of Java Runtime Environment (JRE) 6.0 Update 2 or higher, and install it to your computer.


New Version should show as (HijackThis log):

C:\Program Files\Java\jre1.6.0_02\… or higher





Read over the following directions. Ask if anything appears unclear to you.



Clean out TEMPORARY FILES procedures:
To clean your temp folder, recycle bin, etc..please download this free tool:

CCleaner http://www.ccleaner.com/downloadbuilds.asp

Install Options:

• Don't install any Toolbars, or other programs, should it ask you!
• Just uncheck the option of installing the Yahoo toolbar.

It will put a shortcut on your Desktop.

Do not run CCleaner until requested later.




We will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet. Accordingly, it is probably a good idea to print out the following directions or copy them to a text file on your desktop using NOTEPAD. Read these instructions carefully and feel free to ask if you're unsure about anything.

SELECT HijackThis FIX ITEMS: Scan with HijackThis and place a check next to these items:

O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/instal...sinstaller.cab
O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/dialer/internazionale_ver10.CAB

O21 - SSODL: Version1 - {3CB3F71A-249F-4C89-B495-4C118789A6D0} - libweb.dll (file missing)

Make sure that all browser windows and internet links are closed, even this one!
CLICK ’FIX CHECKED’ with HijackThis.



HIDDEN FILES: To make sure you can see all hidden files, please follow the directions here

SAFEMODE: Boot into safe mode by tapping the F8 key at restart and choosing 'safe mode' menu option (explained here if needed).



Delete TEMPORARY FILES: Now, use CCleaner to hunt down the most common temporary file locations and the temporary file clutter contained therein (and of possible malware hiding places):

Run CCleaner.

FIRST-TIME USE:
Select the ”Options” BUTTON option (top LEFT), ”Advanced” BUTTON, and then UNCHECK the ”Only delete files in Windows Temp Folders older than 48 hours”. Set back to default afterwards.

Select the ”Cleaner” BUTTON option (top LEFT), if not already selected. Use the ”Windows” TAB up front by default.

• Uncheck ”Cookies” option (advisable)
• Optionally, Uncheck ”Recently Typed URLs” option (potentially still useful)
• Click the ”Analyse” button.
• Thereafter, click ”Run Cleaner” after you have reviewed what it proposes to clean.

POST A REVISED HIJACKTHIS LOG for review:
Reboot and post a new HijackThis log with any feedback as appropriate - how things are now behaving: any new or remaining apparent issues.