Can someone please look at the attached MBAM log?

I am running some diagnostics for my Father in Law. He has been experiencing issues with IE8. Sometimes websites will not load, and sometimes they are really, really slow. He also mentioned that if he double clicks IE8 shortcuts on his desktop, he has more problems than when he starts IE8 from the "start" menu. I ran MBAM and SAS, results below. Am I good, or do I need to do more?

Any insight would really be appreciated.

MBAM found just one item:

Malwarebytes' Anti-Malware 1.41
Database version: 3021
Windows 5.1.2600 Service Pack 3

10/24/2009 8:41:51 AM
mbam-log-2009-10-24 (08-41-51).txt

Scan type: Full Scan (C:\|I:\|)
Objects scanned: 224470
Time elapsed: 1 hour(s), 13 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Dan Neinas\Local Settings\Temporary Internet Files\pse_350_enu.exe (Trojan.Agent) -> Quarantined and deleted successfully.


SAS found:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/23/2009 at 10:01 PM

Application Version : 4.29.1004

Core Rules Database Version : 4187
Trace Rules Database Version: 2103

Scan type : Complete Scan
Total Scan Time : 01:17:25

Memory items scanned : 666
Memory threats detected : 0
Registry items scanned : 6822
Registry threats detected : 0
File items scanned : 84755
File threats detected : 219

Adware.Tracking Cookie
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjk4alczwho.stats.esomniture[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@avgtechnologies.112.2o7[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@insightexpressai[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@pt.crossmediaservices[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@cmss.bettersex[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@stat.dealtime[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@paypal.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@qnsr[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wfkoqgazcko.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@truedoorcounty[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@propertiesofdoorcounty.com.bvrd[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@tremor.adbureau[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wdloagd5keq.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@discounttire[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@homestore.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@tracking.admarketplace[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjkykndjwbo.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@directhomediscount[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@oasn04.247realmedia[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@discounttiredirect[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6whmiahdzwho.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@nikon.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@kelleybluebook.112.2o7[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@msnportal.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@levelwing.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adinterax[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@www.wiidiscountstore[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@shopica[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjkoapajkhp.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adverticum[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@superpages.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@discounttire.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@immigration.findlaw[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.pointroll[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adopt.specificclick[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.discounttire[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@serving-sys[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@interclick[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@collective-media[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@samsclub.112.2o7[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@beachcamera.122.2o7[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@sales.liveperson[4].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@xxxblackbook[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.costumediscounters[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@specificclick[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@myweather.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@specificmedia[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ad.fed.msn[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.mail[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@kontera[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wgkiekc5ifo.stats.esomniture[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@shopping.112.2o7[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@iacas.adbureau[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@propertiesofdoorcounty[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@link.mercent[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjlownc5ahp.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@track.bestbuy[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@atwola[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.financialcontent[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@nextag[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@windowsmedia[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adbrite[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@content.bettersex[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@antactica.ad.adnetwork.com[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@versuscountrybagamonsterbuck[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@databazaar.hpsuppliesfinder[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@e-2dj6wfkygiazohp.stats.esomniture[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adlegend[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@clickauditor[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@microsoftwga.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@anad.tacoda[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wfkioncjckq.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@adecn[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@richmedia.yahoo[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@msnbc.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adserver.adtechus[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@sales.liveperson[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@chitika[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@tacoda[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adknowledge[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@bs.serving-sys[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@sales.liveperson[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.clickmanage[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@gpstracklog[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjkokocjofo.stats.esomniture[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.burstbeacon[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[5].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@gandermountain.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adserve.podaddies[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.cnn[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@bettersex[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wdk4aodpaho.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ussearch.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.lucidmedia[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.bettersex[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@foxinteractivemedia.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@trvlnet.adbureau[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@d.mediaforceads[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[5].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[7].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@247realmedia[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@invitemedia[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wfkygpdpmbo.stats.esomniture[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@bizrate[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjloqldpkhp.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@superstats[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@revsci[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@farecastcom.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.shutterfly[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.associatedcontent[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@cdn4.specificclick[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@track.cbs[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjkysjd5wbq.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan neinas@CAKVLJ45.txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@milwaukeecountymuseum[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wfk4kgazmgo.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.addynamix[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@goodyear.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@videoegg.adbureau[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@realmedia[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.bridgetrack[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[6].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@traffic.prod.cobaltgroup[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@stats.paypal[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@gmgmacfs.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@roiservice[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@oddcast[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@login.tracking101[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@edge.ru4[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.aol.co[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@sales.liveperson[5].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[11].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@network.realmedia[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[3].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@marketlive.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@overtons.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@a1.interclick[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adfarm1.adition[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@click.tvprocessing[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@eharmony.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@at.atwola[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@audit.median[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@associatedcontent.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.costumediscounters[3].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@costumediscounters[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.xxxblackbook[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@perf.overture[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.meredithads[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[4].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjlislazweo.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@oasn03.247realmedia[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.discountboatcover[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@media6degrees[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@pro-market[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@overture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@questionmarket[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adtech[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.peoplefinders[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[4].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wfk4uhcpceo.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@care2.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@findlaw[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[9].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[3].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@azjmp[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@discountboatcover[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@aoluk.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@trafficmp[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@prnewswire.122.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[6].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@nextstat[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@gsicace.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@pointroll[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[8].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wjkokoazkco.stats.esomniture[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@dc.tremormedia[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@sitestat.mayoclinic[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.undertone[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[8].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.socialtrack[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@cms.trafficmp[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[7].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@microsoftmachinetranslation.112.2o7[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@traveladvertising[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@peoplefinders[2].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@lucidmedia[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@partners.trafficz[1].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[9].txt
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads2.wissports[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adecn[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adinterax[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adlegend[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@adopt.specificclick[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.financialcontent[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.pointroll[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@ads.revsci[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@anad.tacoda[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@atwola[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@beachcamera.122.2o7[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@click4bestbuy[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@collective-media[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@e-2dj6wfkygiazohp.stats.esomniture[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@feed.validclick[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@insightexpressai[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@interclick[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@kelleybluebook.112.2o7[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@nextag[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@server.iad.liveperson[3].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@shopping.112.2o7[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@specificclick[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@stat.dealtime[2].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[1].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.googleadservices[3].txt
I:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@www.wiidiscountstore[1].txt

ATF
Please download ATF Cleaner by Atribune & save it to your desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main "Select Files to Delete" choose: Select All.
• Click the Empty Selected button.
• If you use Firefox browser click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
• If you use Opera browser click Opera at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
• Click Exit on the Main menu to close the program.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

========================================



Please download Dr.Web CureIt, the free version & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:

• Double-click on launch.exe to open the program and click Start. (There is no need to update if you just downloaded the most current version
• Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
• If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All.
• When complete, click Select All, then choose Cure > Move incurable.
  (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)

• Now put a check next to Complete scan to scan all local disks and removable media.
• In the top menu, click Settings > Change settings, and UNcheck "Heuristic analysis" under the "Scanning" tab, then click Ok.
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
• When the scan is complete, a message will be displayed at the bottom indicating if any viruses were found.
• Click "Yes to all" if asked to cure or move the file(s) and select "Move incurable".
• In the top menu, click file and choose save report list.
• Save the DrWeb.csv report to your desktop.
• Exit Dr.Web Cureit when done.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

===========================================


We Need to check for Rootkits with RootRepeal

• Download RootRepeal from the following location and save it to your desktop.
  • Direct Download (Recommended)
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
    • Secondary Mirror
  • Zip Mirrors (Recommended if you have a slower connection or if the Direct Download mirror is down)
    
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
  • Rar Mirrors - Only if you know what a RAR is and can extract it.
    
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
• Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
• Open on your desktop.
• Click the tab.
• Click the button.
• Check all seven boxes:
• Push Ok
• Check the box for your main system drive (Usually C:), and press Ok.
• Allow RootRepeal to run a scan of your system. This may take some time.
• Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

Thank you so much for the reply and your help. I followed the instructions in your last post. Here are a couple of observations:

1. When I clicked on the "DrWeb" link, it took me to the website, but it was written in Russian, or something. I was unable to read anything, so I was unable to download. I got it done from another computer.

2. When DrWeb ran, it had a message that stated (paraphrase) "HOSTS file modified. Restore Default HOSTS file?" I chose "Yes"

3. I ran the same 3 items on my 3 computers. All 3 gave me the message #2. I have some additional questions about these scans, but can I insert questions about those scans here, or do I need a new post? (I don't want to overstep the scope of your assistance. I am very grateful!)

OK, so here are the reports that you asked for:

Dr. Web Log

RegUBP2b-Dan Neinas.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Deleted.;
A0031721.reg;C:\System Volume Information\_restore{63D6D35D-2A20-4EEE-AA42-6D4C70FE846E}\RP527;Trojan.StartPage.1505;Deleted.;
A0031839.reg;C:\System Volume Information\_restore{63D6D35D-2A20-4EEE-AA42-6D4C70FE846E}\RP530;Trojan.StartPage.1505;Deleted.;

Root Repeal Log:


ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/10/28 06:54
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB2900000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBAE16000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xAFD5E000 Size: 49152 File Visible: No Signed: -
Status: -

==EOF==

When I clicked on the "DrWeb" link, it took me to the website, but it was written in Russian,
HOSTS file modified. Restore Default HOSTS file

both can happen because of the infection. I'm not happy with the RR log. Let's try a couple more

=================================


Please download Win32kDiag.exe by AD and save it to your desktop.
alternate download 1
alternate download 2

• This tool will create a diagnostic report
• Double-click on Win32kDiag.exe to run and let it finish.
• When it states Finished! Press any key to exit..., press any key on your keyboard to close the program.
• A file called Win32kDiag.txt should be created on your Desktop.
• Open that file in Notepad and copy/paste the entire contents (from Starting up... to Finished! Press any key to exit...) in your next reply.

--------------------------------------


Go to > Run..., then copy and paste this command into the open box: cmd
Click OK.
At the command prompt C:\>, copy and paste the following command and press Enter:

DIR /a/s %windir%\scecli.dll %windir%\netlogon.dll %windir%\eventlog.dll >Log.txt & START notepad Log.txt

A file called log.txt should be created on your Desktop.
Open that file and copy/paste the contents in your next reply.

========================


Vista users can refer to these instructions to open a command prompt.

Alternatively you can do this:

Please download peek.bat and save it to your Desktop. Double-click on peek.bat to run it. A black Command Prompt window will appear indicating the program is running. Once it is finished, copy and paste the entire contents of the Log.txt file it creates in your next reply.

If you encounter a problem downloading or getting peek.bat to run, go to > Run..., and in the open box, type: Notepad

• Click OK.
• Copy and paste everything in the code box below into the Untitled - Notepad.

@ECHO OFF
DIR /a/s C:\WINDOWS\scecli.dll C:\WINDOWS\netlogon.dll C:\WINDOWS\eventlog.dll C:\Windows\cngaudit.dll >Log.txt
START Log.txt
DEL %0

• Go to File > Save As, click the drop-down box to change the Save As Type to *All Files and save it as "peek.bat" on your desktop.
• Double-click peek.bat to run the script.
• A window will open and close quickly, this is normal.
• A file called log.txt should be created on your Desktop.
• Open that file and copy/paste the contents in your next reply.

-- Vista users, users can refer to these instructions to Run a Batch File as an Administrator.

Father in law says the machine is working better already! Thanks, again. I have followed your instructions, and the logs are posted below. When I tried Start>Run then copy and paste, it gave a message about "Windows cannot find DIR". I followed the instuctions for peek.bat and that worked fine.

Win32kDiag Log:

Running from: C:\Documents and Settings\Dan Neinas\Desktop\Win32kDiag.exe

Log file at : C:\Documents and Settings\Dan Neinas\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!

Peek.bat Log:

Volume in drive C is Western Digital Local HD
Volume Serial Number is B473-23A6

Directory of C:\WINDOWS\$NtServicePackUninstall$

02/28/2006 07:00 AM 180,224 scecli.dll

Directory of C:\WINDOWS\$NtServicePackUninstall$

02/28/2006 07:00 AM 407,040 netlogon.dll

Directory of C:\WINDOWS\$NtServicePackUninstall$

02/28/2006 07:00 AM 55,808 eventlog.dll
3 File(s) 643,072 bytes

Directory of C:\WINDOWS\ServicePackFiles\i386

04/13/2008 07:12 PM 181,248 scecli.dll

Directory of C:\WINDOWS\ServicePackFiles\i386

04/13/2008 07:12 PM 407,040 netlogon.dll

Directory of C:\WINDOWS\ServicePackFiles\i386

04/13/2008 07:11 PM 56,320 eventlog.dll
3 File(s) 644,608 bytes

Directory of C:\WINDOWS\system32

04/13/2008 07:12 PM 181,248 scecli.dll

Directory of C:\WINDOWS\system32

04/13/2008 07:12 PM 407,040 netlogon.dll

Directory of C:\WINDOWS\system32

04/13/2008 07:11 PM 56,320 eventlog.dll
3 File(s) 644,608 bytes

Total Files Listed:
9 File(s) 1,932,288 bytes
0 Dir(s) 286,133,948,416 bytes free

Please update and run SAS again



Download Sophos ARK to your Desktop from here:
http://www.sophos.com/products/free-tools/...ti-rootkit.html

Sophos does not update itself, so be sure to download the latest version from their website.

Double-click on the icon and the wizard will guide you through the installation

It is recommended that you close down all non-essential programs

Depending on the individual computer the scan can take anywhere from 5 minutes to over an hour

Start the scan by clicking Start>Programs>Sophos>Sophos Anti Rootkit>Sophos Anti Rootkit

Select the checkboxes for the areas you wish to scan
Select the Extensive scan option

Click Start scan or hit Enter

The names of suspicious files are displayed in the results list in the upper panel

The results list may also display registry keys or values. these items should not be marked for removal

If you have any question on a file not automatically marked, go to the Sophos website: www.sophos.com
Type in the name ofthe file in the searchbox at the top of the homepage and click Search

Click Clean up checked itemsand when the dialog box appears, click yes
When the dialog box reappears, reboot the computer

A second scan is recommended

To remove Sophos ARK from your computer, go to Start>Programs>Sophos>Sophos Anti Rootkit>Uninstall Sophos Anti Rootkit

Edited by garmanma, 29 October 2009 - 06:38 PM.

I don't think I really understand what I am doing with Sophos Anti Rootkit. I ran the scan, and it came up with a bunch (like 185) of "Unknown Hidden File". Am I supposed to "Clean up" all of those items? None of them were already checked. For fear of really screwing something up, I have not done anything!

Also, I was not able to do this. It was grayed out. >>Select the Extensive scan option

SAS Log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/29/2009 at 09:11 PM

Application Version : 4.29.1004

Core Rules Database Version : 4212
Trace Rules Database Version: 2119

Scan type : Complete Scan
Total Scan Time : 01:15:20

Memory items scanned : 665
Memory threats detected : 0
Registry items scanned : 6823
Registry threats detected : 0
File items scanned : 70477
File threats detected : 1

Adware.Tracking Cookie
C:\Documents and Settings\Dan Neinas\Cookies\dan_neinas@collective-media[1].txt

Edited by bomber1712, 29 October 2009 - 09:20 PM.

Don't bother with Sophos
You look clean to me. As long as there are no other complaints

Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Then use Disk Cleanup to remove all but the most recently created Restore Point.
• Go to Start > Run and type: Cleanmgr
• Click "Ok"
• Disk Cleanup will scan your files for several minutes, then open.
• Click the "More Options" Tab.
• Click the "Clean up" button under System Restore.
• Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
• Click Yes, then click Ok.
• Click Yes again when prompted with "Are you sure you want to perform these actions?"
• Disk Cleanup will remove the files and close automatically.

Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

Thank You soooo much!! All reports indicate that the computer is working GREAT! I want to thank you and everyone on this forum for the generous support that you offer!