19 replies to this topic

[sookiw2233]

A program TagASaurus has appeared on my computer and has been causing problems for me lately. So I have tried to get rid of the "problem" but keeps reappearing on my desktop. I have run ad-aware and spybot and has gotten rid of everything that it has detected but the problem still did not cease. During the scans I have noticed other programs that were under the "spyware" and I have tried to uninstall those programs but, like the TagASaurus, keeps reappearing. This has caused me to recieve an unbearable amount of pop-ups and DLL errors. It has also changed the appearance of my desktops items, creating some kind of outline around all of them. When I press Ctrl+Alt+Del, the taskbar manager does not pop up. Any help would be most appreciated.


Here's my Log:



Logfile of HijackThis v1.99.1
Scan saved at 2:21:09 PM, on 8/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\askmakb.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\outlook\outlook.exe
C:\WINDOWS\SYSC00.exe
C:\WINDOWS\win320735584279.exe
C:\WINDOWS\askmakbA.exe
C:\WINDOWS\errorhandler.exe
C:\valve\steam\steam.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\EQAdvice\EQAdvice.exe
c:\progra~2\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\PROGRA~2\MUSICM~1\MUSICM~2\MMDiag.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\CheckS02.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\PEngine\PEngine.exe
C:\WINDOWS\system32\5A5B5A61605C5.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.174.173.5:80
R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
F2 - REG:system.ini: UserInit=userinit.exe
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\prefs.js)
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~2\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ctknkhml] C:\WINDOWS\ctknkhml.exe
O4 - HKLM\..\Run: [aim bib second ping] C:\Documents and Settings\All Users\Application Data\thatbeepaimbib\coolenc.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard6.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad6.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname6.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
O4 - HKLM\..\Run: [q8lg] "C:\WINDOWS\system32\slk8x2peu.exe"
O4 - HKLM\..\Run: [win320735584279] C:\WINDOWS\win320735584279.exe
O4 - HKLM\..\Run: [askmakbA] C:\WINDOWS\askmakbA.exe
O4 - HKLM\..\Run: [errorhandler] C:\WINDOWS\errorhandler.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun
O4 - HKLM\..\Run: [win320855842793] C:\WINDOWS\win320855842793.exe
O4 - HKLM\..\Run: [3738373E3D393C4] 5A5B5A61605C5.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [BrowserUpdateSched] C:\WINDOWS\SYSTEM32\owinsrag.exe CORN001
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BoreHeck] C:\DOCUME~1\ADMINI~1\APPLIC~1\RECTPI~1\Managerwaymeal.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [SOProc_RegSoAlertWxSzNn] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~2\SOFTWA~1\soproc.exe -pack RegSoAlertWxSzNn
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [EQAdvice] "C:\Program Files\EQAdvice\EQAdvice.exe"
O4 - HKCU\..\Run: [PEngine] "C:\Program Files\PEngine\PEngine.exe"
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Startup: Zeno.lnk = C:\WINDOWS\SYSTEM32\owinsrag.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangoc...e9a3cd8511bec83
O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} - http://www.pacimedia...ll/pcs_0002.exe
O18 - Protocol: bw+0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {CF1E30DA-B986-4E49-A0B9-0C267E8751DD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Filter: text/html - {CEA53356-C414-4331-A35E-AA4CE9D8DFA2} - C:\WINDOWS\system32\w9seq.dll
O20 - AppInit_DLLs: repairs303169566.dll
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\n84slih7184.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VGh1YW4\command.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\askmakb.exe

[sookiw2233]

My friend told me of a website named www.$$$$$ and told me to visit their site. Upon doing so, my friend told me to analyze my log by pasting it in the box that the site provides. The site then provided me with a list of which files or lines where bad/nasty. My friend then told me to check the boxes that the site had said to be nasty or unknown and delete TagASaurus off my desktop. Since I have complete faith in my friend, I did what he had instructed. I checked all the boxes that where under the nasty or unknown category and "fixed" them and deleted TagASaurus off my desktop. This has not ceased the problem of the unbearable pop-ups I receive and I am still unable to access my Taskbar Manager. All this has done was that it made my log much shorter and the deletion of TagASaurus (which has not reappeared on my desktop for about 3 hours now). My desktop icons still did not change and still has the same boldness outlining around them. Again I'd like to thank you guys in advance for your soon to be support.


Here's my new log:


Logfile of HijackThis v1.99.1
Scan saved at 12:28:05 AM, on 8/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\outlook\outlook.exe
C:\valve\steam\steam.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Common Files\Windows\services32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.174.173.5:80
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\prefs.js)
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ctknkhml] C:\WINDOWS\ctknkhml.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [win320855842793] C:\WINDOWS\win320855842793.exe
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe
O4 - Startup: Zeno.lnk = C:\WINDOWS\SYSTEM32\owinsrag.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Run - C:\WINDOWS\system32\l60u0gd9e60.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Thanks Again!

Edited by LDTate, 29 March 2006 - 08:13 PM.

[LDTate]

Hello sookiw2233, Welcome to the forum.

This is what I suggest you do.


Please do not delete anything unless instructed to.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
-- Click the Gear wheel at the top of the Ad-Aware window
-- Click General > Safety & Settings: Check (Green) all three.
-- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Next:

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.


Next:

Please download the trial version of ewido anti-malware 3.5 here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan and the Spy Sweeper file

Also please describe how your computer behaves at the moment.

[sookiw2233]

First, I would like to thank you for your service for it is really appreciated. I would like to inform you with what i have done before reading and following your instructions to give you an idea with what I have done and hopefully I have done nothing wrong. In the future, I will only do things that are instructed and nothing else. But, what I have done before reading your reply was running both Ad-Aware and Spybot (both fully updated). After running those programs I ran CW Shredder and "fixed" whatever it had detected. Then I ran Ewido in Safe Mode and deleted all the infections (which was about 8500 -- I guess that's pretty bad ).

Now I have followed your instructions and ran all the scans on how you have instructed me to do so. And During all my scans, the only program that was running was the program doing the scan.

My computer now seems to be running very smoothly since the Spyware and Malware scans with some pop-ups every now-and-then but everything seems to be to be fixed and fine.


Here are my logs starting with my Hijack this log and since my logs are disgustingly long, I have posted them as "new reply"'s and i apologize for the length of these logs, I will first add on my Spy Sweeper log, then my Ewido log (most recent), then finally my other Ewido Log (yesterday before reading your instructions/reply).:


Logfile of HijackThis v1.99.1
Scan saved at 12:59:01 PM, on 8/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\valve\steam\steam.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.174.173.5:80
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\prefs.js)
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ctknkhml] C:\WINDOWS\ctknkhml.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [win320855842793] C:\WINDOWS\win320855842793.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [LDM] \Program\
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\g004ladq1d0e.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Edited by sookiw2233, 30 March 2006 - 01:52 PM.

[sookiw2233]

This is my Spy Sweeper Log: ******** 10:21 AM: | Start of Session, Wednesday, August 30, 2006 | 10:21 AM: Spy Sweeper started 10:21 AM: Sweep initiated using definitions version 644 10:21 AM: Starting Memory Sweep 10:22 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:22 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:22 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:22 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:23 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:23 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:23 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:23 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:23 AM: Memory Sweep Complete, Elapsed Time: 00:02:10 10:23 AM: Starting Registry Sweep 10:24 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:24 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:24 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:24 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:24 AM: Found Adware: command 10:24 AM: HKLM\system\currentcontrolset\services\cmdservice\ (4 subtraces) (ID = 958670) 10:24 AM: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\0000\ (6 subtraces) (ID = 1016064) 10:24 AM: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\ (8 subtraces) (ID = 1016072) 10:24 AM: Found Adware: 180search assistant/zango 10:24 AM: HKCR\saix.installercaller.1\ (3 subtraces) (ID = 1156609) 10:24 AM: HKCR\saix.installercaller\ (5 subtraces) (ID = 1156613) 10:24 AM: HKLM\software\classes\saix.installercaller.1\ (3 subtraces) (ID = 1156657) 10:24 AM: HKLM\software\classes\saix.installercaller\ (5 subtraces) (ID = 1156661) 10:24 AM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/saix.dll\ (2 subtraces) (ID = 1156667) 10:24 AM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\saix.dll (ID = 1156675) 10:24 AM: Found Adware: quicklink search toolbar 10:24 AM: HKCR\fseytdc.ariaqudok\ (3 subtraces) (ID = 1180460) 10:24 AM: HKCR\fseytdc.ariaqudok.1\ (3 subtraces) (ID = 1180464) 10:24 AM: HKCR\fseytdc.yvakt\ (3 subtraces) (ID = 1180468) 10:24 AM: HKCR\fseytdc.yvakt.1\ (3 subtraces) (ID = 1180472) 10:24 AM: HKLM\software\classes\fseytdc.ariaqudok\ (3 subtraces) (ID = 1180510) 10:24 AM: HKLM\software\classes\fseytdc.ariaqudok.1\ (3 subtraces) (ID = 1180514) 10:24 AM: HKLM\software\classes\fseytdc.yvakt\ (3 subtraces) (ID = 1180518) 10:24 AM: HKLM\software\classes\fseytdc.yvakt.1\ (3 subtraces) (ID = 1180522) 10:24 AM: Found Adware: dollarrevenue 10:24 AM: HKCR\typelib\{3a76a523-4fbc-487c-a94f-a94ea80e48ef}\ (9 subtraces) (ID = 1198901) 10:24 AM: HKLM\software\classes\typelib\{3a76a523-4fbc-487c-a94f-a94ea80e48ef}\ (9 subtraces) (ID = 1198962) 10:24 AM: Found Adware: clkoptimizer 10:24 AM: HKCR\clsid\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}\ (6 subtraces) (ID = 1212644) 10:24 AM: HKLM\software\classes\clsid\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}\ (6 subtraces) (ID = 1212651) 10:24 AM: Found Adware: zquest 10:24 AM: HKU\S-1-5-21-1390067357-2052111302-682003330-500\software\microsoft\internet explorer\desktop\components\0\ || source (ID = 1140816) 10:24 AM: Found Adware: fullcontext 10:24 AM: HKU\S-1-5-21-1390067357-2052111302-682003330-500\software\eqadvice\ (8 subtraces) (ID = 1190273) 10:24 AM: Registry Sweep Complete, Elapsed Time:00:00:09 10:24 AM: Starting Cookie Sweep 10:24 AM: Found Spy Cookie: toplist cookie 10:24 AM: administrator@toplist[1].txt (ID = 3557) 10:24 AM: Found Spy Cookie: belnk cookie 10:24 AM: administrator@ath.belnk[1].txt (ID = 2293) 10:24 AM: Found Spy Cookie: zone-media cookie 10:24 AM: administrator@ayb.zone-media[1].txt (ID = 3765) 10:24 AM: Found Spy Cookie: metareward.com cookie 10:24 AM: administrator@metareward[2].txt (ID = 2990) 10:24 AM: Found Spy Cookie: screensavers.com cookie 10:24 AM: administrator@www.screensavers[1].txt (ID = 3298) 10:24 AM: Found Spy Cookie: counter cookie 10:24 AM: administrator@counter[1].txt (ID = 2477) 10:24 AM: Found Spy Cookie: 888 cookie 10:24 AM: administrator@888[3].txt (ID = 2019) 10:24 AM: Found Spy Cookie: banners cookie 10:24 AM: administrator@banners[1].txt (ID = 2282) 10:24 AM: administrator@metareward[1].txt (ID = 2990) 10:24 AM: administrator@888[4].txt (ID = 2019) 10:24 AM: Found Spy Cookie: 66.220.17 cookie 10:24 AM: administrator@66.220.17[1].txt (ID = 1991) 10:24 AM: Found Spy Cookie: 360i cookie 10:24 AM: administrator@ct.360i[1].txt (ID = 1962) 10:24 AM: Found Spy Cookie: stamps.com cookie 10:24 AM: administrator@stamps[1].txt (ID = 3437) 10:24 AM: administrator@dist.belnk[1].txt (ID = 2293) 10:24 AM: Found Spy Cookie: gamespy cookie 10:24 AM: administrator@gamespy[1].txt (ID = 2719) 10:24 AM: Found Spy Cookie: reunion cookie 10:24 AM: administrator@reunion[1].txt (ID = 3255) 10:24 AM: Found Spy Cookie: ic-live cookie 10:24 AM: administrator@ic-live[1].txt (ID = 2821) 10:24 AM: Found Spy Cookie: askmen cookie 10:24 AM: administrator@askmen[2].txt (ID = 2247) 10:24 AM: Found Spy Cookie: nextag cookie 10:24 AM: administrator@nextag[2].txt (ID = 5014) 10:24 AM: administrator@888[6].txt (ID = 2019) 10:24 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00 10:24 AM: Starting File Sweep 10:24 AM: Warning: Failed to open file "c:\pagefile.sys". Access is denied 10:24 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:24 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:24 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:24 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:24 AM: wnu_100.exe (ID = 268798) 10:24 AM: Found Adware: enbrowser 10:24 AM: pf78.exe (ID = 244430) 10:24 AM: win320735584279.exe (ID = 270029) 10:24 AM: pf78ba.exe (ID = 268846) 10:24 AM: pf78bb.exe (ID = 251313) 10:24 AM: Found Adware: visfx 10:24 AM: errorhandler.exe (ID = 268840) 10:24 AM: Found Adware: look2me 10:24 AM: guard.tmp (ID = 159) 10:25 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:25 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:25 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:25 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:25 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:25 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:25 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:25 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:26 AM: Warning: Failed to open file "c:\windows\system32\q8860ilse8q60.dll". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\ir24l5fq1.dll". The process cannot access the file because it is being used by another process 10:26 AM: mksawrtal.amf (ID = 208796) 10:26 AM: cv3wanv28.exe (ID = 259982) 10:26 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:26 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:26 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:26 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:26 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:26 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:26 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:26 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\security.log". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\software.log". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\system.log". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\default.log". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\sam.log". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\security". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\software". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\system". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\sam". The process cannot access the file because it is being used by another process 10:26 AM: Warning: Failed to open file "c:\windows\system32\config\default". The process cannot access the file because it is being used by another process 10:27 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:27 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:27 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:27 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:27 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:27 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:27 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:27 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:28 AM: Warning: Failed to open file "c:\windows\softwaredistribution\eventcache\{75994649-a979-4f12-b35a-552b36e5a9d7}.bin". The process cannot access the file because it is being used by another process 10:28 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:28 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:28 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:28 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:29 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:29 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:29 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:29 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:30 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:30 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:30 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:30 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:30 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:30 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:30 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:30 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:31 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:31 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:31 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:31 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:31 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:31 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:31 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:31 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:31 AM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat.log". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat.log". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs63a24578-5497-4039-9f48-256dfe0b65c3.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd9b51ef5-1a4a-43d1-90d2-4a22fc50e13f.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs95858ca6-bfb9-40ad-9f46-7ae84de6d583.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs181d4788-7db8-418c-8199-c34ac63a8eca.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfb43c8e4-56d7-4e16-8bad-2b2034e4bf30.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs88ec995a-e7c2-4137-af8d-6d24e0127d97.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs17b62314-12bc-4502-96a8-18c46cc9795e.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5da5d41f-081c-42f3-aa47-75452dbebfe3.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs412067ca-283f-4862-be9e-c9584d2711de.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs92e6670d-d5af-4def-95cf-a36c35331851.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa3fc1508-ba2f-40a9-b7df-caa519078bbf.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs08bce759-a55d-445d-b526-f0c0440312da.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscdb77383-6439-49e7-9e07-a88afee00b6d.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0a3a9996-4eee-4d2f-9bde-f01a08b7b815.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs12685447-9eaf-4bb4-a5ab-304d5f99cc59.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7724e909-1a40-4751-abf4-90bde22c7c8d.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse0e74415-7095-49de-8a6c-56d06ac071b6.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsade13c44-1cb9-4110-9aec-5d4ca1db71d1.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0f5d8847-b90f-4177-b1f1-3002b740fac3.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs813b3e59-da40-4c5f-84fb-8849a0d29bf2.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs26c55c60-bcf0-431f-8d2f-19f84df4a241.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscseda8809a-d596-41ce-8488-32d0549decf7.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs85bd1f3e-cf7c-4c7c-a3c1-63d23f7004f5.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc1fee954-4dd2-4c36-828d-2514679519b0.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs41fb8f1b-782e-495e-a8e1-b58b5604b92b.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbd665f0c-8db6-4dfa-9525-c4d9663def99.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf292ce81-7a41-4eba-971c-047ba48b5178.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1d4b9cfc-76ef-401f-beea-0249089574cb.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9a351047-b7b4-4aa5-b995-f1cf6e022991.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc5f2178a-8926-43d4-8ca8-87bfa09dbd69.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse9deac51-e17e-4111-b3fe-6f8d8843affc.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc4efdadc-ab13-4d41-87c8-a51f3cd4a098.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1b14655d-4650-40cd-bd70-6a4c0bb1faaa.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs74050082-382f-4d48-866f-65983fa65fdb.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbf1a81f2-2bb5-4752-a7cf-b72287ae2740.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscseb6a4a00-1ce8-49fe-85ca-e6566a096075.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb81b82b7-5712-4941-bcdc-ff5541ac062c.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs914750e3-1e63-4aff-acf6-a771347184c9.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbbd78839-b4d0-4292-83e4-09a0a80feefa.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs690921f4-b35e-4280-9926-1dae253294d8.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs03b701e0-996e-43ec-a636-e6e94ecd3c75.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscbd8f55a-90c1-4b76-9b04-7bfaf5f75f21.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc638567a-46d0-4db4-bcdd-be198c6fe06f.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd7d34012-9e90-46c7-b986-ebef7d1c8406.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0911b6b6-efb1-4c23-9b31-4df2e9bc6b42.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7092f55c-d79b-45c5-84e9-8247fc7577e7.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0ada429f-d44e-486f-8530-cb7958de86f2.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs86391293-d028-4686-bb2c-711f416ea24e.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs08228fdd-a729-4839-a71f-c7bbaae06d1c.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse5cf3439-0c48-42c4-84f6-35e156082538.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf1a87ba5-acc3-4d10-86ef-e1b4a719c756.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsac253bd3-75ab-4958-a5b3-f7e9964d0151.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse29754a8-20a0-4ca4-90f6-c5691f6a3d5c.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs10bf6fa3-1017-434a-97a6-a3d49c16fb58.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs03b4b5b1-1738-45d2-b4d5-b15249573a5c.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs51d8e788-02ba-4179-a625-7fdd3ddd351d.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs97c627c7-247e-42b2-8918-eb647afa9a54.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscseebbf3c2-5e2e-4742-ad48-37903ee30f65.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7ee7d664-d25b-43cf-9d21-6ad10dbedeba.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs43744537-5ec5-4106-90de-9399ae718f5f.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb77e677c-f521-4513-838c-d221aa840c8a.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs880efbef-74a5-473e-bfee-d3e8ce64a25e.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs34703e00-815a-4091-bc3e-4ad5a17529ed.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs49733e9d-a8aa-4bac-9dd3-4397910ae837.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs2d017821-e023-4d6b-b902-5b5449a584b3.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs720d5be0-0486-4b1c-976e-d7782bd7627b.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6a4e0cdc-8068-4642-863c-dfe916615367.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs509ee789-d9d5-4bc0-b89d-2421bbaa1605.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsda9a265a-7289-40b3-b34c-12c62873a427.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs60745329-6712-4664-b01a-c85f1a74862f.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs40c45c39-aff6-465e-b057-5ab961e5c29c.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs97ff1780-c592-4a8e-aaf7-1a387c49d828.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd9cb9c6e-93a8-4d7d-86ab-491a23ef2a8c.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs13846992-ef27-4fc5-925e-d477e52b185c.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1e17072e-1f72-4062-9ba6-243eb91e904e.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4f420689-d976-4481-85b8-ba48566d4d78.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5e3a7ad7-4846-4bfc-9d02-99da7cced659.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscseecac026-f745-41a3-b664-8377c6284950.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs11ef5d18-f907-4ba9-b3e4-58b6c48c734a.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc0dac859-0a4f-45b6-9d02-3661ed560471.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9b4cc318-2fc7-43bb-85a4-b4e871052c7c.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9348eed1-ee4e-4498-81da-ee94da653f9e.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9b5790e9-9ca8-459c-95bb-526c60fac6e0.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7c3a7ed9-ff6c-4524-aa04-57fca124ccb0.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs851652a7-9f17-4f7b-a547-18978502d1ae.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs35469e4f-e0ab-47e6-b043-7f9354174751.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7cd2c462-b751-427e-9286-9943917dde6a.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf49cb442-b0e1-41bb-a924-1986bb0e0113.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs31d3b6f5-47cb-4f64-a4ed-9ed3901864e1.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsaa661403-c81a-4216-b69c-d113a43407c7.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4b20d5e0-797c-459d-b736-d6602c79c763.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9e90ac2c-4bf2-452e-a96e-addc2caa54e2.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd41dbedd-5609-46da-9b81-80200146bae3.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9e2036d4-f0ae-45d6-a711-b95361a215ed.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb8c8afa4-64d6-4f03-86ca-1f7bd1b31aee.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscd2fe7cd-d000-42e2-9f6e-2539079df0e8.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9531f031-700d-449d-ba92-d81d39b97a83.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5dc7c9ba-e18d-41ba-9e76-f6caf770e68f.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsec86e6e4-15a0-4977-8262-a893b716d44a.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsaab92884-706e-408e-a32a-8fdbe17289fa.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs97dd04e3-1c2d-487c-b6cd-00b930076051.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd5a3859a-a72e-4d48-b339-a7117f94baa9.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs692fe726-477b-431e-8627-3fe4c2d077a3.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs2d7b5359-2818-4a6d-a219-086066dcf1a2.tmp". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\administrator\ntuser.dat.log". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\administrator\ntuser.dat". The process cannot access the file because it is being used by another process 10:31 AM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\cp2v4dij\pt detec.ted". The system cannot find the file specified 10:32 AM: dolrevwrld2[1].ini (ID = 268430) 10:32 AM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process 10:32 AM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process 10:32 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:32 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:32 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:32 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:32 AM: Found Adware: targetsaver 10:32 AM: tsupdate2[1].ini (ID = 193498) 10:32 AM: contextualapp[1].exe (ID = 258286) 10:32 AM: Found Adware: deskwizz 10:32 AM: newfrn[1].ini (ID = 239476) 10:32 AM: Found Adware: zenosearchassistant 10:32 AM: ag[1].exe (ID = 254879) 10:32 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:32 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:32 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:32 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:33 AM: Warning: Failed to open file "c:\documents and settings\administrator\application data\securom\userdata\???????????p???????? ". The system cannot find the file specified 10:33 AM: Warning: Failed to open file "c:\documents and settings\administrator\application data\securom\userdata\???????????p??????????? ". The system cannot find the file specified 10:33 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:33 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:33 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:33 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:33 AM: Found Adware: surfsidekick 10:33 AM: c:\program files\common files\vcclient (9 subtraces) (ID = -2147461290) 10:33 AM: clientupdater.bat (ID = 212353) 10:33 AM: vcclient.exe (ID = 212828) 10:33 AM: vcclient.exe.config (ID = 212358) 10:33 AM: vcmain.exe (ID = 212830) 10:33 AM: vcupdate.exe (ID = 212831) 10:33 AM: vcupdate.exe.config (ID = 212361) 10:33 AM: class-barrel (ID = 78229) 10:33 AM: vocabulary (ID = 78283) 10:34 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:34 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:34 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:34 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:34 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:34 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:34 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:34 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:35 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:35 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:35 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:35 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:35 AM: npclntax.dll (ID = 207057) 10:35 AM: npclntax.xpt (ID = 146238) 10:35 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:35 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:35 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:35 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:36 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:36 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:36 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:36 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:37 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:37 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:37 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:37 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:37 AM: c:\program files\search-assistant (ID = -2147480560) 10:37 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:37 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:37 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:37 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:38 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:38 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:38 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:38 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:38 AM: Found Trojan Horse: trojan downloader matcash 10:38 AM: c:\program files\outlook (ID = -2147454834) 10:39 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:39 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:39 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:39 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:39 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:39 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:39 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:39 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:39 AM: c:\program files\eqadvice (4 subtraces) (ID = -2147454476) 10:39 AM: c:\program files\fcadvice (1 subtraces) (ID = -2147454475) 10:40 AM: eqadvice.exe (ID = 257943) 10:40 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:40 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:40 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:40 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:40 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:40 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:40 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:40 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:41 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:41 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:41 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:41 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:42 AM: Warning: Invalid Stream 10:42 AM: Warning: Invalid Stream 10:42 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:42 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:42 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:42 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:42 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:42 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:42 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:42 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:43 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:43 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:43 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:43 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:43 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:43 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:43 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:43 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:44 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:44 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:44 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:44 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:45 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:45 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:45 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:45 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:45 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:45 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:45 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:45 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:46 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:46 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:46 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:46 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:47 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:47 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:47 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:47 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:47 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:47 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:47 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:47 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:48 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:48 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:48 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:48 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:48 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:48 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:48 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:48 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:50 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:50 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:50 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:50 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:50 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:50 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:50 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:50 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:51 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:51 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:51 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:51 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:52 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:52 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:52 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:52 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:53 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:53 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:53 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:53 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:53 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:53 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:53 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:53 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:54 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:54 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:54 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:54 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:55 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:55 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:55 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:55 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:55 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:55 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:55 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:55 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:57 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:57 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:57 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:57 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:58 AM: The

[sookiw2233]

This is my Spy Sweeper Log (cont.): 10:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:59 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:59 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 10:59 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 10:59 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:00 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:00 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:00 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:00 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:00 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:00 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:00 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:00 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:01 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:01 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:01 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:01 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:01 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:01 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:01 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:01 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:04 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:04 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:04 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:04 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:04 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:04 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:04 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:04 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:05 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:05 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:05 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:05 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:05 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:05 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:05 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:05 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:06 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:06 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:06 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:06 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:06 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:06 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:06 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:06 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:07 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:07 AM: Warning: Invalid Stream 11:07 AM: Warning: Invalid Stream 11:08 AM: Warning: Invalid file - not a PKZip file 11:08 AM: Warning: Invalid file - not a PKZip file 11:08 AM: Warning: Invalid file - not a PKZip file 11:08 AM: Warning: Invalid file - not a PKZip file 11:08 AM: Warning: Invalid file - not a PKZip file 11:08 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:08 AM: File Sweep Complete, Elapsed Time: 00:44:32 11:08 AM: Full Sweep has completed. Elapsed time 00:46:59 11:08 AM: Traces Found: 185 11:08 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:08 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:09 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:10 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:10 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:10 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:10 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:10 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:10 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:10 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:10 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:11 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:12 AM: Removal process initiated 11:12 AM: Quarantining All Traces: 180search assistant/zango 11:12 AM: Quarantining All Traces: clkoptimizer 11:12 AM: Quarantining All Traces: fullcontext 11:12 AM: Quarantining All Traces: look2me 11:12 AM: look2me is in use. It will be removed on reboot. 11:12 AM: guard.tmp is in use. It will be removed on reboot. 11:12 AM: Quarantining All Traces: trojan downloader matcash 11:12 AM: Quarantining All Traces: visfx 11:12 AM: Quarantining All Traces: dollarrevenue 11:12 AM: Quarantining All Traces: enbrowser 11:12 AM: Quarantining All Traces: quicklink search toolbar 11:12 AM: Quarantining All Traces: surfsidekick 11:12 AM: Quarantining All Traces: zquest 11:12 AM: Quarantining All Traces: command 11:12 AM: Quarantining All Traces: deskwizz 11:12 AM: Quarantining All Traces: targetsaver 11:12 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:12 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:12 AM: Quarantining All Traces: zenosearchassistant 11:12 AM: Quarantining All Traces: 360i cookie 11:12 AM: Quarantining All Traces: 66.220.17 cookie 11:12 AM: Quarantining All Traces: 888 cookie 11:12 AM: Quarantining All Traces: askmen cookie 11:12 AM: Quarantining All Traces: banners cookie 11:12 AM: Quarantining All Traces: belnk cookie 11:12 AM: Quarantining All Traces: counter cookie 11:12 AM: Quarantining All Traces: gamespy cookie 11:12 AM: Quarantining All Traces: ic-live cookie 11:12 AM: Quarantining All Traces: metareward.com cookie 11:12 AM: Quarantining All Traces: nextag cookie 11:12 AM: Quarantining All Traces: reunion cookie 11:12 AM: Quarantining All Traces: screensavers.com cookie 11:12 AM: Quarantining All Traces: stamps.com cookie 11:12 AM: Quarantining All Traces: toplist cookie 11:12 AM: Quarantining All Traces: zone-media cookie 11:12 AM: Preparing to restart your computer. Please wait... 11:12 AM: Removal process completed. Elapsed time 00:00:41 11:15 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:15 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:15 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:15 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:16 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:16 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:16 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:16 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:17 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:17 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:17 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:17 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:19 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:19 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com 11:19 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com 11:19 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com ******** 10:19 AM: | Start of Session, Wednesday, August 30, 2006 | 10:19 AM: Spy Sweeper started 10:19 AM: Your spyware definitions have been updated. 10:21 AM: | End of Session, Wednesday, August 30, 2006 |

Edited by sookiw2233, 30 March 2006 - 01:48 PM.

[sookiw2233]

this is my Ewido Log (most recent): --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 12:19:34 PM, 8/30/2006 + Report-Checksum: A943B8B9 + Scan result: [696] C:\WINDOWS\system32\iUsacct.dll -> Adware.Look2Me : Error during cleaning [788] C:\WINDOWS\system32\iUsacct.dll -> Adware.Look2Me : Error during cleaning C:\WINDOWS\SYSTEM32\jlaw400.dll -> Adware.Look2Me : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned with backup :mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup :mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup :mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.19:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.20:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.21:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.22:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.26:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup :mozilla.27:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup :mozilla.28:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup :mozilla.48:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.49:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.50:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.51:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.52:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137559.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137471.exe -> Backdoor.Rbot : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137472.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137473.dll -> Adware.Suggestor : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137474.dll -> Adware.Agent : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137475.exe -> Adware.ZenoSearch : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137476.dll -> Trojan.VB.aft : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137477.exe -> Downloader.Adload.ae : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137478.exe -> Downloader.VB.zo : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137479.exe -> Hijacker.VB.ly : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137480.exe -> Downloader.VB.tw : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137481.exe -> Trojan.VB.tg : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137482.exe -> Trojan.VB.tg : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137483.exe -> Trojan.VB.tg : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137484.dll -> Adware.BookedSpace : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137485.exe -> Trojan.VB.tg : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137486.exe -> Worm.VB.an : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137487.dll -> Adware.CASClient : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137488.exe -> Dropper.Agent.aie : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137489.exe -> Downloader.Agent.afi : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137490.EXE -> Adware.NewDotNet : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137491.exe -> Adware.ZenoSearch : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137492.exe -> Trojan.Small : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137494.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137501.DLL -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137502.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137516.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137552.dll -> Adware.Look2Me : Cleaned with backup ::Report End

[sookiw2233]

Ewido (before reading your reply): --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 12:19:34 PM, 8/30/2006 + Report-Checksum: A943B8B9 + Scan result: [696] C:\WINDOWS\system32\iUsacct.dll -> Adware.Look2Me : Error during cleaning [788] C:\WINDOWS\system32\iUsacct.dll -> Adware.Look2Me : Error during cleaning C:\WINDOWS\SYSTEM32\jlaw400.dll -> Adware.Look2Me : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup C:\WINDOWS\Temp\Cookies\administrator@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned with backup :mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup :mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup :mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.19:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.20:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.21:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.22:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.26:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup :mozilla.27:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup :mozilla.28:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup :mozilla.48:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.49:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.50:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.51:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.52:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137559.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137471.exe -> Backdoor.Rbot : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137472.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137473.dll -> Adware.Suggestor : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137474.dll -> Adware.Agent : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137475.exe -> Adware.ZenoSearch : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137476.dll -> Trojan.VB.aft : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137477.exe -> Downloader.Adload.ae : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137478.exe -> Downloader.VB.zo : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137479.exe -> Hijacker.VB.ly : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137480.exe -> Downloader.VB.tw : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137481.exe -> Trojan.VB.tg : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137482.exe -> Trojan.VB.tg : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137483.exe -> Trojan.VB.tg : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137484.dll -> Adware.BookedSpace : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137485.exe -> Trojan.VB.tg : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137486.exe -> Worm.VB.an : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137487.dll -> Adware.CASClient : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137488.exe -> Dropper.Agent.aie : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137489.exe -> Downloader.Agent.afi : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137490.EXE -> Adware.NewDotNet : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137491.exe -> Adware.ZenoSearch : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137492.exe -> Trojan.Small : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137494.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137501.DLL -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137502.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137516.dll -> Adware.Look2Me : Cleaned with backup C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137552.dll -> Adware.Look2Me : Cleaned with backup ::Report End

[LDTate]

Download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES.
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.

Please download the trial version of ewido anti-malware 3.5 here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.


While still in Safe Mode:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ctknkhml] C:\WINDOWS\ctknkhml.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [win320855842793] C:\WINDOWS\win320855842793.exe
O4 - HKCU\..\Run: [LDM] \Program\
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\g004ladq1d0e.dll

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete these folders if listed:
C:\Program Files\outlook


Delete these files if listed:
C:\WINDOWS\ctknkhml.exe
C:\Program Files\outlook\outlook.exe
C:\WINDOWS\win320855842793.exe
C:\WINDOWS\system32\g004ladq1d0e.dll


Open C:\Windows\Prefetch\ Delete ALL files in this folder.



Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED PROFILE USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

[sookiw2233]

Hello again. After following your instructions, my computer is still running very smoothly causing no problem at all besides the pop-ups every once in a while while im browsing the net. But having pop-ups every once in a while is normal, right?

Well anyways, I have followed your instructions and here are the following logs:


HiJackThis Log:


Logfile of HijackThis v1.99.1
Scan saved at 1:13:50 AM, on 8/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\valve\steam\steam.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.174.173.5:80
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\prefs.js)
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\j66mlgj116o.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe




Ewido log:


---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 12:56:45 AM, 8/31/2006
+ Report-Checksum: 279FA189

+ Scan result:

[712] C:\WINDOWS\system32\izetmib1.dll -> Adware.Look2Me : Error during cleaning
[796] C:\WINDOWS\system32\izetmib1.dll -> Adware.Look2Me : Error during cleaning
C:\WINDOWS\SYSTEM32\mvdrv.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\Temp\Cookies\administrator@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\WINDOWS\Temp\Cookies\administrator@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
C:\WINDOWS\Temp\Cookies\administrator@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\WINDOWS\Temp\Cookies\administrator@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.12:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137562.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137565.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP401\A0137569.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137578.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137582.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137586.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137590.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137594.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137598.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137634.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137638.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{7394B7FD-6767-45E4-8630-7AF341DF7B6E}\RP402\A0137642.dll -> Adware.Look2Me : Cleaned with backup


::Report End

[LDTate]

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Post #1
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."...then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.

[sookiw2233]

Hello. I have followed your instructions and here is the following log from l2mfix. L2MFIX find log 032106 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Font] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\f0j2la1o1d.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier] "Asynchronous"=dword:00000000 "DllName"="WRLogonNTF.dll" "Impersonate"=dword:00000001 "Lock"="WRLock" "StartScreenSaver"="WRStartScreenSaver" "StartShell"="WRStartShell" "Startup"="WRStartup" "StopScreenSaver"="WRStopScreenSaver" "Unlock"="WRUnlock" "Shutdown"="WRShutdown" "Logoff"="WRLogoff" "Logon"="WRLogon" ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{6D999C2D-9474-E078-DEF1-C974E22D3B79}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{E0D79304-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79305-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79306-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79307-84BE-11CE-9641-444553540000}"="WinZip" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes" "{FED7043D-346A-414D-ACD7-550D052499A7}"="dBpowerAMP Music Converter 1" "{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter" "{41261008-2D4C-48A3-A7BC-F3A857B087A3}"="CMWCUTIL Menu Extension" "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper" "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band" "{4E77F802-914D-4F6F-81EA-A3D796990F22}"="" "{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}"="" "{0775A5DA-5012-45EC-BD74-7D2A707766D9}"="" "{5D06A82D-6511-44AA-A825-58EDEABD4ACB}"="" "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration" "{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}] @="" [HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}\InprocServer32] @="C:\\WINDOWS\\system32\\uzrdpa.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}] @="" [HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}\InprocServer32] @="C:\\WINDOWS\\system32\\hqtpapi.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}] @="" [HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}\InprocServer32] @="C:\\WINDOWS\\system32\\ckadmin.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}] @="" [HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}\InprocServer32] @="C:\\WINDOWS\\system32\\sudpapi.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ sudpapi.dll Thu Aug 31 2006 9:06:00a ..S.R 236,879 231.32 K cmdlin~2.dll Mon Aug 21 2006 8:45:14p A.... 43,520 42.50 K fpl203~1.dll Thu Aug 31 2006 9:06:00a ..S.R 237,112 231.55 K f0j2la~1.dll Thu Aug 31 2006 1:10:56a ..S.R 236,879 231.32 K 4 items found: 4 files (3 H/S), 0 directories. Total of file sizes: 754,390 bytes 736.71 K Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Volume in drive C has no label. Volume Serial Number is 0354-17E9 Directory of C:\WINDOWS\System32 08/31/2006 09:06 AM 236,879 sudpapi.dll 08/31/2006 09:06 AM 237,112 fpl2033oe.dll 08/31/2006 01:10 AM 236,879 f0j2la1o1d.dll 08/25/2005 09:56 PM 9,216 Thumbs.db 01/10/2005 08:23 PM 56 3B58DB8307.sys 01/05/2005 05:17 PM <DIR> dllcache 01/05/2005 04:07 PM <DIR> Microsoft 5 File(s) 720,142 bytes 2 Dir(s) 29,711,269,888 bytes free To give you an update on my computer, it still runs smoothly and has pop-ups once in a while. Thanks.

[LDTate]

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

Note : Once the pc has restarted if a log does not appear or the icons didn't disappear, run the "second.bat" located inside the L2mfix folder.

After the fix portion is done. Please run the option to restore the winlogon defaults (menu option 4) as most of the notify key is missing. After you do that post an option 1 log again.


IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
If after the reboot the desktop icons dont dissappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix.

[sookiw2233]

Hello. I have followed your instructions and here are the logs:

l2mfix log (#2, Run Fix):

L2mfix 032106
Creating Account.
The command completed successfully.

Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 432 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 528 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1860 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1280 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
Deleting: C:\WINDOWS\system32\f0j2la1o1d.dll
Successfully Deleted: C:\WINDOWS\system32\f0j2la1o1d.dll
Deleting: C:\WINDOWS\system32\fpl2033oe.dll
Successfully Deleted: C:\WINDOWS\system32\fpl2033oe.dll
Deleting: C:\WINDOWS\system32\kt62l7jo1.dll
Successfully Deleted: C:\WINDOWS\system32\kt62l7jo1.dll
Deleting: C:\WINDOWS\system32\WzhRm.dll
Successfully Deleted: C:\WINDOWS\system32\WzhRm.dll

msg11?.dll
0 file(s) copied.
Desktop.ini sucessfully removed




Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\f0j2la1o1d.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\f0j2la1o1d.dll
C:\WINDOWS\system32\fpl2033oe.dll
C:\WINDOWS\system32\kt62l7jo1.dll
C:\WINDOWS\system32\WzhRm.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}\InprocServer32]
@="C:\\WINDOWS\\system32\\uzrdpa.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}\InprocServer32]
@="C:\\WINDOWS\\system32\\hqtpapi.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}\InprocServer32]
@="C:\\WINDOWS\\system32\\ckadmin.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}\InprocServer32]
@="C:\\WINDOWS\\system32\\WzhRm.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{4E77F802-914D-4F6F-81EA-A3D796990F22}"=-
"{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}"=-
"{0775A5DA-5012-45EC-BD74-7D2A707766D9}"=-
"{5D06A82D-6511-44AA-A825-58EDEABD4ACB}"=-
"{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}"=-
[-HKEY_CLASSES_ROOT\CLSID\{4E77F802-914D-4F6F-81EA-A3D796990F22}]
[-HKEY_CLASSES_ROOT\CLSID\{4A41F9E5-97C2-4BA7-B514-19B70FD64E35}]
[-HKEY_CLASSES_ROOT\CLSID\{0775A5DA-5012-45EC-BD74-7D2A707766D9}]
[-HKEY_CLASSES_ROOT\CLSID\{5D06A82D-6511-44AA-A825-58EDEABD4ACB}]
[-HKEY_CLASSES_ROOT\CLSID\{F0BE6505-0DA7-43A0-BA16-AC85AD85BA28}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/f0j2la1o1d.dll (deflated 6%)
adding: dlls/fpl2033oe.dll (deflated 6%)
adding: dlls/kt62l7jo1.dll (deflated 4%)
adding: dlls/WzhRm.dll (deflated 6%)
adding: backregs/notibac.reg (deflated 87%)
adding: backregs/shell.reg (deflated 73%)
adding: backregs/4E77F802-914D-4F6F-81EA-A3D796990F22.reg (deflated 70%)
adding: backregs/4A41F9E5-97C2-4BA7-B514-19B70FD64E35.reg (deflated 70%)
adding: backregs/5D06A82D-6511-44AA-A825-58EDEABD4ACB.reg (deflated 70%)
adding: backregs/F0BE6505-0DA7-43A0-BA16-AC85AD85BA28.reg (deflated 70%)



HiJackThis Log:


Logfile of HijackThis v1.99.1
Scan saved at 3:01:43 PM, on 8/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\valve\steam\steam.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.174.173.5:80
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\prefs.js)
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\f0j2la1o1d.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe


l2mfix (#1, after running #4):


Logfile of HijackThis v1.99.1
Scan saved at 3:01:43 PM, on 8/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\valve\steam\steam.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.174.173.5:80
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\q3l477qz.slt\prefs.js)
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\f0j2la1o1d.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Thanks.

[LDTate]

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\f0j2la1o1d.dll (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete these Files if listed:
C:\WINDOWS\system32\f0j2la1o1d.dll




Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at