Need help with LOP, Thanks

Please install HJT properly per step 7 of the READ ME. You have it where we ask that it not be install:

C:\Documents and Settings\Cory\Desktop\HijackThis.exe


You should also uninstall Morpheus and mIrc. Possibly the root cause of your infections. This is one of the worst cases of Lop I have seen.

You are going to have to login to each user account to clean these files as the all seem to have infections.

 

Okay in addition to uninstalling the P2P programs already mentioned, also uninstall
Viewpoint Manager

Below is a list of files you must delete. You may have to login to each user account to delete this. Not since all these accounts are infected, you really should run the READ ME on each user account to really be sure they are clean. However, you do not have to do the online scanners in step 6 again.

Use Windows Explorer to locate and delete the below files:

All Users user account
C:\Documents and Settings\All Users\Application Data\dashclosefirstinside <--- delete the whole dashclosefirstinside folder

April user account
C:\Documents and Settings\April\Application Data\Internet glue less <--- delete the whole Internet glue less folder
C:\Documents and Settings\April\Application Data\nounsect <--- delete the whole nounsect folder
C:\Documents and Settings\April\Local Settings\Temp <--- delete ALL files in this Temp folder

Now run Ccleaner while logged into the April account!

Carol user account
C:\Documents and Settings\Carol\Application Data\Internet glue less <--- delete the whole Internet glue less folder
C:\Documents and Settings\Carol\Application Data\nounsect <--- delete the whole nounsect folder
C:\Documents and Settings\Carol\Local Settings\Temp <--- delete ALL files in this Temp folder
C:\Documents and Settings\Carol\Local Settings\Temporary Internet Files\Content.IE5\Z8PFBPCE\newpass2[1].htm

Now run Ccleaner while logged into the Carol account!

John user account
C:\Documents and Settings\John\Application Data\Internet glue less <--- delete the whole Internet glue less folder
C:\Documents and Settings\John\Application Data\nounsect <--- delete the whole nounsect folder
C:\Documents and Settings\John\Local Settings\Temp <--- delete ALL files in this Temp folder

Now run Ccleaner while logged into the John account!

Patrick user account
C:\Documents and Settings\Patrick\Application Data\Internet glue less <--- delete the whole Internet glue less folder
C:\Documents and Settings\Patrick\Local Settings\Temp <--- delete ALL files in this Temp folder

Now run Ccleaner while logged into the Patrick account!

The below are common files you should be able to delete as long as you are logged in with Admin priviledges.
C:\Program Files\Common Files\orqi <--- delete the whole folder
C:\toolbar_uninstall.exe
C:\WINDOWS\SYSTEM32\mbho2.dll
C:\WINDOWS\SYSTEM32\mo030414s.dll
C:\WINDOWS\SYSTEM32\winbpupd.exe
C:\WINDOWS\msbb.exe.temp
C:\WINDOWS\SYSTEM32\mocupd.exe
C:\temp\pootz_58.exe
C:\temp\package8029_CDT3.exe
C:\Program Files\Morph20.exe

Let me know how this all goes and if you are having any other malware problems.

 

Did you notice how the scanners were detecting them as problems?

Also read the info here: http://www.spywareinfo.com/articles/p2p/

All P2P programs are dangerous to use and some contain malware. Some like Morpheus can be clean based upon which version. Some of them lie to you when they advertise they are clean and you better read the license and privacy agreements carefully.