This is the second Malwarebytes scan after I removed everything I could from the first scan results. Malwarebytes' Anti-Malware 1.35 Database version: 1939 Windows 5.1.2600 Service Pack 3 04/03/2009 11:04:36 PM mbam-log-2009-04-03 (23-04-36).txt Scan type: Full Scan (C:\:) Objects scanned: 119355 Time elapsed: 47 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 15 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 8 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\acpi32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore"415790D9-BB81-41AF-9469-EEC2DB43FA43>\RP997\A0179839.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\acpi32.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\amd64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\netsik.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\nicsk32.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\fips32cup.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\i386si.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ati64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

Ravencajun, Last night I did another scan, It was very slow. I use Charter's High speed internet Security Suiet. It comes with my internet service. This trojan is not listed in their definitions. To be honest I have run into it previously and thought if they didn't do anything with it, it must not be serious. It was the email that allerted me to a possible connection. I also get some notices that say something that is acting as a server wants access. I always click deny! The following is the report after last night's scan. I really apperciate your concern and helpfulness! _________________________________________ Scanning Report 25 August 2009 20:30:53 - 21:55:14 Computer name: D2JGNZB1 Scanning type: Scan target Target: C:\ -------------------------------------------------------------------------------- Result No malware found -------------------------------------------------------------------------------- Riskware found Downloader.Win32.Agent.q (Riskware) C:\14B5.tmp -------------------------------------------------------------------------------- Statistics Scanned: Files: 132306 Not scanned: 21 Result: Viruses: 0 Spyware: 0 Suspicious items: 0 Riskware: 1 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 Quarantined: 0 Failed: 0 Boot Sectors: Scanned: 2 Infected: 0 Suspicious items: 0 Disinfected: 0 Files not scanned: Cannot open file (click here for more info) C:\PAGEFILE.SYS Cannot open file (click here for more info) C:\WINDOWS\TEMP\AVP427.TMP Cannot open file (click here for more info) C:\WINDOWS\TEMP\AVP428.TMP Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SAM Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Scanning of C:\WINDOWS\Installer\149cc.msp\stream 574 was aborted [F-Secure AVP] Scanning of C:\Program Files\Charter High-Speed Security Suite\FSAUA\content\70Software_PSC800\34\program\inst\fsma_7.80-127260.windows.fip\fsma\x86-windows\ILAUNCHR.EXE was aborted [F-Secure AVP] Scanning of C:\i386\DRIVER.CAB was aborted [F-Secure AVP] Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\ANGUSHIRE MEDOWS.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\COMPUTER HELPS AND TIPS.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\INBOX.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\HAYJUDO50.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(2C545ACC-8A17-4851-B0AB-238D63125F07)\MICROSOFT\OUTLOOK EXPRESS\INBOX.DBX -------------------------------------------------------------------------------- Options Definitions version: Viruses: 2009-08-25_08 Spyware: 2009-08-25_08 Scanning Engines: F-Secure AVP: 7.00.171, 2009-08-25 F-Secure Hydra: 4.00.9271, 2009-08-25 Scanning options: Scan all files Scan inside archives Actions: Viruses: Ask after scan Spyware: Ask after scan -------------------------------------------------------------------------------- Error information "Cannot open file" error occurred: The "Cannot open file" error message means that the scanner was unable to open a file and that this file was not scanned. You can normally ignore this error message as there are many reasons for this message that do not imply a security threat, including: The file was a system file. System files are protected by the operation system by design. You can ignore this message in this case. You do not have permission to read the file. To scan the file, log in with a user account with sufficient permissions (for example the computer's administrator account) and rescan. The file was in use by an application when the scan was performed. To scan this file, close all applications and rescan. -------------------------------------------------------------------------------- Copyright 1998-2008 Product support : Send virus sample to F-Secure

Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 4:47:37 PM, on 9/18/2011 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\AVAST Software\Avast\avastUI.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Webshots\Webshots.scr C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\AGI\core\4.0\AGCoreService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - (72853161-30C5-4D22-B7F9-0BBC1D38A37E) - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: avast! WebRep - (8E5E2654-AD2D-48bf-AC2D-D17F00898D06) - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - (E7E6F031-17CE-4C07-BC86-EABFE594F69C) - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: avast! WebRep - (8E5E2654-AD2D-48bf-AC2D-D17F00898D06) - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe ...

msm84, When your Grand daughter "x-ed" it out. That may have been how it got installed after visiting a bad website. NEVER X OUT or even touch the screen with your cursor/mouse on a popup of this type. What you want to do is to left click the taskbar and bring up the Task Manager and end the process. This type of Rogue program is called Scareware. It entices you to purchase the program to remove malicious content that is fictitious. This is a complete scam as the scan results are all fake and many of the listed files are actually legitimate files that if removed could cause problems for your computer. Antivirus 8 will also attempt to protect itself by not allowing you to run various programs that may assist in removing it. When you attempt to run these types of programs, Antivirus8 will terminate it and then state that the file is infected. In conjunction to installing SpywareBlaster, I also recommend her to install WOT (Web of Trust). This will prevent access to bad sites as long as you heed the warnings to not enter them. Self discipline is the key to prevention! Please follow through with getting professional help before installing anything more. Even if you use MBAM in safe mode, there is still a registry key that will be needing attention! These programs are very aggressive and do leave traces behind. Good Luck! bbbluz Here is a link that might be useful: WOT Free download