'Hijack this' log for checking

[Broni]

I did the system restore as requested, but I might need to look into this again at the end - I've had problems doing this is in the past (I usually get an error message saying that the machine could not be returned to an earlier point).

You're not supposed to do any system restore. You're supposed to RESET system restore, as described in my earlier post.

================================================================

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\system32\ezsidmv.dat
c:\docume~1\Michael\LOCALS~1\Temp\CTT2B7.tmp

Folder::

Driver::

Registry::

RegLockDel::

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

[Monkton]

Hi Broni,

sorry - I wasn't very clear in the last mail - I did Reset the System Restore as per your instructions (rather then actually do a system restore). I think the reset failed as there are still restore points showing prior to the Reset. Anyway, I'll look into that again when we next get to that stage. In the meantime here are the new logs...

ComboFix 10-01-28.05 - Michael 29/01/2010 17:08:10.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.506 [GMT 0:00]
Running from: c:\documents and settings\Michael\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Michael\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"c:\docume~1\Michael\LOCALS~1\Temp\CTT2B7.tmp"
"c:\windows\system32\ezsidmv.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ezsidmv.dat
c:\windows\TEMP\logishrd\LVPrcInj01.dll

.
((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-29 )))))))))))))))))))))))))))))))
.

2010-01-27 19:29 . 2010-01-27 19:29 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-27 09:03 . 2010-01-27 09:03 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-01-26 11:33 . 2010-01-26 11:33 38 ---h--w- c:\windows\system32\ccmichael.sys
2010-01-25 17:22 . 2010-01-25 17:22 2145 ----a-w- c:\documents and settings\Michael\Application Data\.purple\certificates\x509\tls_peers\ows.messenger.msn.com
2010-01-25 10:10 . 2010-01-25 10:10 -------- d-sh--w- c:\documents and settings\Michael\PrivacIE
2010-01-25 09:36 . 2010-01-25 09:36 -------- d-sh--w- c:\documents and settings\Michael\IETldCache
2010-01-25 09:22 . 2010-01-25 09:27 -------- dc-h--w- c:\windows\ie8
2010-01-25 09:12 . 2010-01-25 09:18 -------- d-----w- c:\documents and settings\Michael\Local Settings\Application Data\ApplicationHistory
2010-01-23 00:30 . 2010-01-23 00:30 -------- d-----w- c:\program files\MSXML 4.0
2010-01-22 23:14 . 2010-01-22 23:14 -------- d-----w- c:\program files\Java
2010-01-22 22:59 . 2010-01-22 22:59 348160 ----a-w- c:\documents and settings\Michael\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-58cc6249-n\msvcr71.dll
2010-01-22 22:59 . 2010-01-22 22:59 503808 ----a-w- c:\documents and settings\Michael\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-58cc6249-n\msvcp71.dll
2010-01-22 22:59 . 2010-01-22 22:59 61440 ----a-w- c:\documents and settings\Michael\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3d90a155-n\decora-sse.dll
2010-01-22 22:59 . 2010-01-22 22:59 499712 ----a-w- c:\documents and settings\Michael\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-58cc6249-n\jmc.dll
2010-01-22 22:59 . 2010-01-22 22:59 12800 ----a-w- c:\documents and settings\Michael\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3d90a155-n\decora-d3d.dll
2010-01-22 22:50 . 2010-01-22 23:10 -------- d-----w- c:\documents and settings\Michael\.SunDownloadManager
2010-01-22 13:38 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2010-01-22 13:38 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2010-01-22 13:38 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-22 13:38 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2010-01-22 13:38 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2010-01-22 13:38 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2010-01-22 13:38 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2010-01-22 13:38 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2010-01-22 13:37 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-22 13:36 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-22 13:34 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-01-22 13:34 . 2009-10-15 16:28 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-01-22 13:33 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-01-22 13:31 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-22 13:31 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-22 13:31 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-22 13:31 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-01-22 13:30 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-22 13:30 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-22 13:28 . 2009-08-04 15:13 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-22 13:28 . 2009-08-04 14:20 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-22 13:28 . 2009-08-04 14:20 2066048 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-01-22 13:28 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-22 13:28 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-01-22 13:27 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2010-01-22 13:27 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-01-22 13:02 . 2010-01-22 13:02 -------- d-----w- c:\windows\system32\XPSViewer
2010-01-22 13:02 . 2010-01-22 13:02 -------- d-----w- c:\program files\MSBuild
2010-01-22 13:02 . 2010-01-22 13:02 -------- d-----w- c:\program files\Reference Assemblies
2010-01-22 13:02 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-01-22 13:01 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-22 13:01 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-01-22 13:01 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-22 13:01 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-01-22 13:01 . 2010-01-22 13:02 -------- d-----w- C:\1e89650396acbe257bfb44ee4a71ca
2010-01-22 13:01 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-22 13:01 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-01-22 13:01 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-01-22 13:01 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-01-22 12:31 . 2009-12-31 15:33 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2010-01-22 12:31 . 2009-03-08 04:31 59904 -c--a-w- c:\windows\system32\dllcache\icardie.dll
2010-01-22 12:31 . 2009-03-08 04:11 445952 -c--a-w- c:\windows\system32\dllcache\ieapfltr.dll
2010-01-22 12:31 . 2009-02-06 21:07 3698584 -c--a-w- c:\windows\system32\dllcache\ieapfltr.dat
2010-01-22 11:40 . 2010-01-26 09:02 -------- d-----w- c:\windows\ie8updates
2010-01-22 11:32 . 2009-12-21 19:14 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-22 11:32 . 2009-12-21 19:14 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-22 11:32 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-01-22 11:32 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-22 11:31 . 2009-12-21 19:14 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-01-22 11:31 . 2009-12-21 19:14 11070464 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-01-22 11:31 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-01-22 11:17 . 2008-04-14 00:15 46592 ------w- c:\windows\system32\drivers\irbus.sys
2010-01-22 11:14 . 2010-01-22 11:18 -------- d-----w- c:\windows\ServicePackFiles
2010-01-22 11:14 . 2007-08-13 18:54 33792 -c--a-w- c:\windows\system32\dllcache\custsat.dll
2010-01-22 10:58 . 2009-08-06 19:24 327896 ----a-w- c:\windows\system32\wucltui.dll
2010-01-22 10:58 . 2009-08-06 19:24 209632 ----a-w- c:\windows\system32\wuweb.dll
2010-01-22 10:58 . 2009-08-06 19:24 35552 -c--a-w- c:\windows\system32\dllcache\wups.dll
2010-01-22 10:58 . 2009-08-06 19:24 35552 ----a-w- c:\windows\system32\wups.dll
2010-01-22 10:58 . 2009-08-06 19:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2010-01-22 10:58 . 2008-04-14 05:42 165888 ----a-w- c:\windows\system32\wuauclt1.exe
2010-01-22 10:58 . 2008-04-14 05:42 183296 ----a-w- c:\windows\system32\wuaueng1.dll
2010-01-21 23:15 . 2010-01-21 23:15 -------- d-----w- C:\_OTM
2010-01-20 11:37 . 2010-01-20 13:02 288 ----a-w- c:\windows\system32\DVCStateBkp-{00000004-00000000-00000000-00001102-00000004-10031102}.dat
2010-01-20 11:37 . 2010-01-20 13:02 288 ----a-w- c:\windows\system32\DVCState-{00000004-00000000-00000000-00001102-00000004-10031102}.dat
2010-01-20 11:35 . 2007-04-09 12:32 335872 ----a-w- c:\windows\system32\ctdc0001.dll
2010-01-20 11:35 . 2007-04-09 12:32 131072 ----a-w- c:\windows\system32\ctdcifce.dll
2010-01-20 11:35 . 2007-04-09 12:32 227840 ----a-w- c:\windows\system32\ctdc0000.dll
2010-01-20 11:35 . 2007-04-09 12:22 76800 ----a-w- c:\windows\system32\ctdproxy.dll
2010-01-20 11:35 . 2007-04-09 12:32 8704 ----a-w- c:\windows\system32\ctagent.dll
2010-01-20 11:31 . 2001-03-30 02:00 62976 ----a-w- c:\windows\system32\CTDetres.dll
2010-01-18 14:12 . 2010-01-18 14:12 -------- d-----w- C:\found.000
2010-01-14 09:31 . 2010-01-25 16:04 -------- d-----w- c:\documents and settings\Michael\Application Data\skypePM
2010-01-14 09:29 . 2010-01-25 20:53 -------- d-----w- c:\documents and settings\Michael\Application Data\Skype
2010-01-14 09:29 . 2010-01-14 09:29 -------- d-----w- c:\program files\Common Files\Skype
2010-01-14 09:28 . 2010-01-14 09:29 -------- d-----r- c:\program files\Skype
2010-01-12 00:12 . 2010-01-12 00:12 2165 ----a-w- c:\documents and settings\Michael\Application Data\.purple\certificates\x509\tls_peers\rsi.hotmail.com
2010-01-02 17:31 . 2010-01-02 17:31 -------- d-----w- c:\program files\SyncToy 2.1
2010-01-02 17:30 . 2010-01-02 17:30 -------- d-----w- c:\program files\Microsoft Sync Framework

[Monkton]

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-29 17:27 . 2009-11-13 22:15 -------- d-----w- c:\program files\Symantec AntiVirus
2010-01-29 13:14 . 2009-11-13 23:54 -------- d-----w- c:\documents and settings\Michael\Application Data\FileZilla
2010-01-29 12:50 . 2009-11-15 16:27 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-27 19:29 . 2009-12-22 13:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-26 22:15 . 2009-11-15 15:47 -------- d-----w- c:\program files\FileZilla FTP Client
2010-01-25 20:47 . 2009-11-30 10:27 -------- d-----w- c:\documents and settings\Michael\Application Data\.purple
2010-01-22 23:15 . 2009-11-16 09:07 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-22 22:59 . 2009-11-13 23:40 -------- d-----w- c:\program files\Common Files\Java
2010-01-22 13:19 . 2009-12-04 09:07 118576 ----a-w- c:\documents and settings\Michael\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-22 11:19 . 2009-11-13 21:16 80943 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-01-20 13:00 . 2010-01-20 11:36 114688 ----a-w- c:\windows\system32\OpenAL32.dll
2010-01-20 13:00 . 2009-11-13 22:56 409600 ----a-w- c:\windows\system32\wrap_oal.dll
2010-01-20 11:40 . 2009-11-13 21:30 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-20 10:51 . 2009-11-14 00:11 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-18 20:42 . 2009-12-15 12:10 -------- d--h--w- c:\documents and settings\All Users\Application Data\catalog.wci
2010-01-14 09:28 . 2009-11-13 23:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-01-07 16:07 . 2009-12-22 13:17 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 . 2009-12-22 13:17 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 18:06 . 2009-11-13 23:37 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-29 09:26 . 2009-12-29 09:26 1691 ----a-w- c:\documents and settings\Michael\Application Data\.purple\certificates\x509\tls_peers\api.screenname.aol.com
2009-12-22 13:17 . 2009-12-22 13:17 -------- d-----w- c:\documents and settings\Michael\Application Data\Malwarebytes
2009-12-22 13:17 . 2009-12-22 13:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-22 13:00 . 2009-12-22 13:00 -------- d-----w- c:\program files\Trend Micro
2009-12-21 19:14 . 2009-11-13 21:58 916480 ------w- c:\windows\system32\wininet.dll
2009-12-21 10:15 . 2009-12-21 10:14 -------- d-----w- c:\program files\Roxio
2009-12-21 10:15 . 2009-12-21 10:13 -------- d-----w- c:\program files\Common Files\Adaptec Shared
2009-12-21 10:15 . 2002-12-17 12:29 25898 ----a-w- c:\windows\system32\drivers\Dvd_2k.sys
2009-12-21 10:15 . 2002-12-17 12:29 30630 ----a-w- c:\windows\system32\drivers\Mmc_2k.sys
2009-12-21 10:15 . 2002-12-17 12:29 143834 ----a-w- c:\windows\system32\drivers\pwd_2K.sys
2009-12-21 10:15 . 2002-12-17 12:27 206464 ----a-w- c:\windows\system32\drivers\udfreadr_xp.sys
2009-12-21 10:15 . 2009-12-21 10:15 57344 ----a-w- c:\windows\uneng.exe
2009-12-15 22:21 . 2009-12-11 15:59 -------- d-----w- c:\documents and settings\Michael\Application Data\Trados
2009-12-15 12:10 . 2009-12-15 12:08 -------- d-----w- c:\program files\SmarThru Office
2009-12-15 12:09 . 2009-12-15 12:09 -------- d-----w- c:\documents and settings\Michael\Application Data\Samsung
2009-12-15 12:09 . 2009-12-15 12:09 -------- d-----w- c:\program files\Common Files\SRC Shared
2009-12-15 12:09 . 2009-11-17 21:33 -------- d-----w- c:\program files\Readiris10
2009-12-15 11:58 . 2009-11-17 21:30 -------- d-----w- c:\program files\SAMSUNG
2009-12-15 11:38 . 2009-12-15 11:38 -------- d-----w- c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2009-12-15 11:38 . 2009-12-15 11:38 -------- d-----w- c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2009-12-15 09:03 . 2009-11-15 18:27 -------- d-----w- c:\program files\ClipCount 2.0
2009-12-11 18:26 . 2009-11-20 00:10 86860 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-11 15:59 . 2009-11-15 19:55 -------- d-----w- c:\documents and settings\All Users\Application Data\SDL International
2009-12-09 23:17 . 2009-11-13 23:32 -------- d-----w- c:\program files\MSECache
2009-12-03 23:14 . 2009-11-18 08:59 -------- d-----w- c:\program files\Logitech
2009-11-30 10:28 . 2009-11-30 10:28 2141 ----a-w- c:\documents and settings\Michael\Application Data\.purple\certificates\x509\tls_peers\omega.contacts.msn.com
2009-11-30 10:28 . 2009-11-30 10:28 2095 ----a-w- c:\documents and settings\Michael\Application Data\.purple\certificates\x509\tls_peers\login.live.com
2009-11-21 15:51 . 2003-07-16 16:17 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-17 17:13 . 2009-11-17 17:13 82944 ----a-w- c:\windows\system32\usbkt1x1.dll
2009-11-17 17:13 . 2009-11-17 17:13 22304 ----a-w- c:\windows\system32\drivers\usbkt1x1.sys
2009-11-17 17:13 . 2009-11-17 17:13 13504 ----a-w- c:\windows\system32\drivers\uks11ldr.sys
2009-11-17 17:13 . 2009-11-17 17:14 724992 ----a-w- c:\windows\iun6002.exe
2009-11-16 09:07 . 2009-11-16 09:07 152576 ----a-w- c:\documents and settings\Michael\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-16 09:06 . 2009-11-16 09:06 79488 ----a-w- c:\documents and settings\Michael\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-15 16:55 . 2009-11-15 16:52 28424003 ----a-w- C:\Wimtrad NG 3.10.13b.ZIP
2009-11-15 16:53 . 2009-11-15 16:52 6447991 ----a-w- C:\MOD_MU90_NEW_2009-10-28_11-07.zip
2009-11-13 21:13 . 2009-11-13 21:13 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-13 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-27 125168]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Acrobat Assistant 8.0"="c:\program files\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"STO Backup Service"="c:\program files\SmarThru Office\BackUpSvr.exe" [2009-07-17 86016]
"STO Launcher Service"="c:\program files\SmarThru Office\LegacyLauncher.exe" [2009-07-17 77824]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2006-08-16 503808]
"CTSysVol"="c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 49152]
"CTDVDDet"="c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 45056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
SDL Trados 2007 Speed Launcher.lnk - c:\program files\SDL International\SDL Trados Synergy 2007\Synergy.exe [2007-12-18 765952]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [15/01/2010 20:05 102448]
R3 USBKT1X1;M-Audio USB Keystation;c:\windows\system32\drivers\usbkt1x1.sys [17/11/2009 17:13 22304]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [27/09/2006 20:33 116464]
S3 UKS11LDR;M-Audio USB Keystation Loader;c:\windows\system32\drivers\uks11ldr.sys [17/11/2009 17:13 13504]
S3 ZD1211BU(3COM Corporation);3Com OfficeConnect Wireless 54Mbps 11g Compact USB Adapter(3COM Corporation);c:\windows\system32\drivers\ZD1211BU.sys [13/11/2009 22:12 477696]
S3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [13/11/2009 22:12 477696]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-29 17:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\docume~1\Michael\LOCALS~1\Temp\CTTB8.tmp 0 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(5724)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTsvcCDA.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Analog Devices\SoundMAX\spkrmon.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
.
**************************************************************************
.
Completion time: 2010-01-29 17:38:48 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-29 17:38
ComboFix2.txt 2010-01-28 14:52
ComboFix3.txt 2010-01-27 17:31

Pre-Run: 60,126,425,088 bytes free
Post-Run: 60,098,265,088 bytes free

- - End Of File - - 3A637FF88470BD8673D39AA8CE2BD851

[Monkton]

..and finally the Hijack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:39:58, on 29/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\SmarThru Office\BackUpSvr.exe
C:\Program Files\SmarThru Office\LegacyLauncher.exe
C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [STO Backup Service] C:\Program Files\SmarThru Office\BackUpSvr.exe
O4 - HKLM\..\Run: [STO Launcher Service] C:\Program Files\SmarThru Office\LegacyLauncher.exe /run
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: SDL Trados 2007 Speed Launcher.lnk = C:\Program Files\SDL International\SDL Trados Synergy 2007\Synergy.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4D054067-DE3A-48F9-B19B-BCD229B9AE8D} (PrinterHelpEtcActiveX Control) - http://www.samsungdp.com/printerhelp.../DrPrinter.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1258159228015
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9929 bytes

[Broni]

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Restart computer.

===============================================================

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.


2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

• Spyware, Adware, Dialers, and other potentially dangerous programs
• Archives
• Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt before clicking on the Save button. Then post it here.

[Monkton]

Dear Broni,

all completed; here's the Kaspersky log...

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, February 1, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, January 31, 2010 21:55:42
Records in database: 3392986
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Objects scanned: 145588
Threats found: 3
Infected objects found: 5
Suspicious objects found: 0
Scan duration: 04:39:40


File name / Threat / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\017C0000\4B7CE05B.VBN Infected: Trojan.Win32.Agent.demb 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\017C0001.VBN Infected: Trojan.Win32.Agent.demb 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\017C0002.VBN Infected: Trojan.Win32.Agent.demb 1
C:\_OTM\MovedFiles\01212010_231539\C_Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0ADC0000\4BDC68A1.VBN Infected: Trojan-Spy.Win32.Zbot.gen 1
C:\_OTM\MovedFiles\01212010_231539\C_System Volume Information\_restore{233404FB-625A-4E3C-93E0-FB87BB4074DA}\RP18\A0002180.bat Infected: Trojan.BAT.Agent.vf 1

Selected area has been scanned.

[Broni]

Please, empty Norton's vault.

=================================================================

Verify your Java version here: http://www.java.com/en/download/installed.jsp
Update, if necessary.
Uninstall all previous Java versions, through Add\Remove (Programs & Features in Vista).

================================================================

When done....


Your computer is clean

1. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

[Monkton]

Dear Broni,

thanks once again for your help and patience; Norton's vault is now empty, system restore has been switched off/machine re-booted and sysem restore switched back on again and this time there are no possible dates to restore to so it has worked correctly.

I know you thought it was coincidence, but I'm not going to tempt fate and visit the Yahoo mail folder - at least on this machine - any time soon.

I'll let you know how things are going after a few days.

with best regards,
Monkton

[Broni]

Very well