Downloader.Agent.uj detected. Ran and did this AVG SCAN #1!
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP562\A0066965.exe -> Adware.SpySheriff : Ignored.
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP569\A0067474.exe -> Adware.SpySheriff : Ignored.
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP491\A0057916.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP491\A0057952.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP492\A0057993.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP492\A0058028.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP493\A0058080.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP493\A0058111.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP493\A0058124.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP493\A0058151.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP494\A0058194.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP494\A0058231.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP495\A0058276.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP496\A0058354.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP496\A0058383.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP497\A0058426.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP497\A0058455.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP499\A0058509.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP500\A0059509.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP501\A0059556.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP501\A0059581.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP501\A0059621.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP502\A0059675.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP503\A0059714.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP503\A0059724.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP504\A0059773.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP504\A0060773.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP505\A0060824.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP506\A0060915.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP512\A0061101.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP512\A0061136.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP513\A0061195.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP513\A0061229.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP513\A0061315.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP514\A0061375.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP515\A0061419.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP516\A0061466.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP517\A0061515.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP518\A0061563.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP519\A0061611.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP519\A0061644.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP520\A0061730.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP521\A0061775.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP522\A0061823.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP523\A0061872.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP523\A0061914.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP524\A0061955.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP524\A0062033.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP526\A0062094.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP528\A0062172.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP528\A0062210.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP529\A0062259.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP530\A0062317.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP530\A0062325.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP531\A0062383.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP532\A0062432.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP533\A0062480.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP534\A0062569.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP535\A0062618.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP536\A0062667.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP537\A0062717.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP538\A0062768.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP538\A0062804.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP539\A0062852.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP539\A0062884.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP540\A0062933.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP540\A0062965.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP542\A0063008.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP542\A0063046.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP542\A0063083.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP543\A0063135.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP544\A0063184.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP544\A0063200.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP545\A0063305.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP546\A0063351.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP547\A0063401.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP547\A0063435.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP549\A0063519.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP549\A0063541.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP549\A0063578.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP550\A0063627.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP551\A0063677.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP552\A0063730.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP553\A0063767.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP553\A0063810.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP554\A0063864.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP555\A0063914.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP555\A0063951.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP557\A0064951.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP559\A0065951.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP561\A0066951.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP562\A0066976.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP562\A0066998.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP562\A0067040.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP563\A0067084.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP563\A0067115.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP564\A0067166.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP564\A0067191.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP565\A0067241.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP566\A0067293.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP567\A0067349.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP567\A0067383.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP569\A0067432.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP570\A0067504.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP570\A0067512.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP570\A0067622.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP571\A0067836.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP571\A0067845.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP571\A0067866.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP571\A0068007.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP572\A0068055.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP573\A0068107.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP573\A0068115.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP573\A0068138.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP573\A0068147.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).


After reboot, AVG detected Downloader.Agent.uj. Again!!! Now, it is picking up MediaPipe P2P as well as the Downloader agent! So i had her run a second AVG scan & run Hijack This! and i will post those results right after this, cause everything won;t fit in this post.

so, after the reboot and detection of downloader again, it was also picking up a P2P. So, I had her run another AVG scan and a Hijack This and here they r and this is where we r at now! Your guidnace will be greatly appreciated!
AVG SCAN #2
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP562\A0066965.exe -> Adware.SpySheriff : Cleaned.
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP569\A0067474.exe -> Adware.SpySheriff : Cleaned.
C:\System Volume Information\_restore{3B27EE0E-7E73-44B8-B59C-8AB75F691F2E}\RP574\A0068227.exe -> Downloader.Agent.uj : Cleaned.
[1580] VM_00A60000 -> Downloader.Agent.uj : Cleaned.
[2084] VM_00390000 -> Downloader.Agent.uj : Cleaned.
[2240] VM_00C20000 -> Downloader.Agent.uj : Cleaned.
[2444] VM_003F0000 -> Downloader.Agent.uj : Cleaned.
[2856] VM_008E0000 -> Downloader.Agent.uj : Cleaned.
[2900] VM_00350000 -> Downloader.Agent.uj : Cleaned.
[2936] VM_00AD0000 -> Downloader.Agent.uj : Cleaned.
[2996] VM_00890000 -> Downloader.Agent.uj : Cleaned.
[3084] VM_003B0000 -> Downloader.Agent.uj : Cleaned.
[3108] VM_008A0000 -> Downloader.Agent.uj : Cleaned.
[3248] VM_00920000 -> Downloader.Agent.uj : Cleaned.
[3296] VM_008D0000 -> Downloader.Agent.uj : Cleaned.
[3828] VM_018C0000 -> Downloader.Agent.uj : Cleaned.
[3888] VM_00880000 -> Downloader.Agent.uj : Cleaned.
[3912] VM_00AE0000 -> Downloader.Agent.uj : Cleaned.
[660] VM_00D60000 -> Downloader.Agent.uj : Cleaned.
[684] VM_00D60000 -> Downloader.Agent.uj : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.

HIJACK THIS LOG:
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA FA.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2OZ8J35V\hijackthis[1]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gatewaybiz.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINDOWS\GWMDMpi.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [EPSON Stylus CX5400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G 1.EXE /P19 "EPSON Stylus CX5400" /O6 "USB001" /M "Stylus CX5400"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MediaPipe P2P Loader] "C:\Program Files\p2pnetworks\mpp2pl.exe" /H
O4 - HKLM\..\Run: [EPSON Stylus CX5400 (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G 1.EXE /P28 "EPSON Stylus CX5400 (Copy 1)" /O6 "USB001" /M "Stylus CX5400"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX7800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA FA.EXE /P26 "EPSON Stylus CX7800 Series" /O6 "USB002" /M "Stylus CX7800"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124318219620
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab53083.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6A55C6F8-6627-4AA0-A94E-0D734528DD50}: NameServer = 85.255.116.18,85.255.112.185
O17 - HKLM\System\CCS\Services\Tcpip\..\{E6F8F6DE-0EAC-4A91-A5CB-7A197BD24759}: NameServer = 205.188.146.145
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = medispan.com,firstdatabank.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = medispan.com,firstdatabank.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe.Run the application.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd

Reboot your computer in Safe Mode.
If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection

The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.
A reboot may be needed to finish the cleaning process, if your computer does not restart automatically please do it yourself manually.
The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Please post:
c:\rapport.txt
A new HijackThis log
Your may need several replies to post the requested logs, otherwise they might get cut off

==========================

Please download FixWareout
Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.
When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items:

O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O17 - HKLM\System\CCS\Services\Tcpip\..\{6A55C6F8-6627-4AA0-A94E-0D734528DD50}: NameServer = 85.255.116.18,85.255.112.185


Should you have problems connecting to the internet after the fix, follow these instrutions.
Please go to Start -> Control Panel Network Connections. Rightclick on your default connection (usually Local Area Connection or Dial-up Connection if you are using Dial-up) and leftclick on Properties. Doubleclick on the Internet Protocol (TCP/IP) item and select the button that says "Obtain DNS servers automatically". Click OK twice, and restart your computer.

THANK U!!!!!

I am executing the smith fraud run first and then will redo hijack this and post.

Then do I do the second part AFTER hearing back from you??? the part where u write about downloading FixWareout...

the link to download the smithfraudfix.exe above is ending in can not be found page. can i download it from this place???

SmitFraudFix

ok, i re read your original instructions above and realize your cue to run after the link got tagged onto the link and that's why there was an error when i clicked on the link. will do the smitfraud in safe mode now and then hijack this and post both logs hopefully soon