What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] baseline

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
hello and thank you for your help in advance i tried different software to elminate what PC Tools Spyware Doctor calls Application.Tracking., CookiesRogueAntiSpyware Spyware_Remover and Adware.Advertizing with relative success (HijackThis did find application called ASKBAR). Spyware Dr. will remove them and after a few minutes of surfing the Net I will get infected again. this is a no end in site problem and i dont know how to solve it. I use Vuze to download files and i hope i can keep using it after this problem is solved. i downloaded and used ThreatExpert Memory Scanner but looks like I am clean. I used Sopcast to watch TV and that is when I notice the problem, a window will pop up with advertising. What is Prevalence Reporter? Zone Alarm Security Alert: " Prevalence reporter is tying to access the trusted zone" i cleaned my HijackThis and this is the result of my last scan: (please help) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:31:50 AM, on 2/25/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\AIM6\aim6.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SoftwareDistribution\Download\2bc0b3c55e0c166e04844934d1c7c342\update\update.exe C:\Program Files\AIM6\aolsoftware.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Update Service (gupdate1c99473d15064c9) (gupdate1c99473d15064c9) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe – End of file - 6507 bytes ———————————— Zone Alarm doesnt erase the following files when I am on the results page: "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adbrite.com.44f92a69";"Found Tracking cookie.Adbrite";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adbrite.com.71beeff9";"Found Tracking cookie.Adbrite";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adbrite.com.d5e309c2";"Found Tracking cookie.Adbrite";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adopt.euroclick.com.17044b51";"Found Tracking cookie.Euroclick";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adopt.euroclick.com.6d7740f7";"Found Tracking cookie.Euroclick";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adopt.euroclick.com.891542da";"Found Tracking cookie.Euroclick";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adopt.euroclick.com.8b1bd7bc";"Found Tracking cookie.Euroclick";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adopt.euroclick.com.fb764ef7";"Found Tracking cookie.Euroclick";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\adopt.euroclick.com.ffe11db7";"Found Tracking cookie.Euroclick";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\advertising.com.1820df7a";"Found Tracking cookie.Advertising";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\advertising.com.1dfa2206";"Found Tracking cookie.Advertising";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\advertising.com.203aa218";"Found Tracking cookie.Advertising";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\advertising.com.525a5fb9";"Found Tracking cookie.Advertising";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\advertising.com.7ae8f949";"Found Tracking cookie.Advertising";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\advertising.com.b624fa46";"Found Tracking cookie.Advertising";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\advertising.com.f62113d5";"Found Tracking cookie.Advertising";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\revsci.net.26b016c3";"Found Tracking cookie.Revsci";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\revsci.net.3f4566dd";"Found Tracking cookie.Revsci";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\revsci.net.50e13b1b";"Found Tracking cookie.Revsci";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\revsci.net.55564293";"Found Tracking cookie.Revsci";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\revsci.net.e9dbeb91";"Found Tracking cookie.Revsci";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\tacoda.net.27341d57";"Found Tracking cookie.Tacoda";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\tacoda.net.4366831a";"Found Tracking cookie.Tacoda";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\tacoda.net.5935e89";"Found Tracking cookie.Tacoda";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\tacoda.net.c4fe2ebb";"Found Tracking cookie.Tacoda";"Moved to Virus Vault" "C:\Documents and Settings\Neo\Application Data\Mozilla\Firefox\Profiles\kzowgget.default\cookies.sqlite:\tacoda.net.ed9c50d1";"Found Tracking cookie.Tacoda";"Moved to Virus Vault"
Post #2
Hi :)

Prevalence Reporter is part of AVG, you should allow it to access the Internet when it asks.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Post that log back here.

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done two logs should open:
  • DDS.txt
  • Attach.txt
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
Thanks.
Post #3
mbam log Time elapsed: 20 minute(s), 50 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ————————————————————————— DDS text DDS (Ver_09-02-01.01) - NTFSx86 Run by [removed] at 10:23:19.53 on Wed 02/25/2009 Internet Explorer: 6.0.2900.2180 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3327.2386 [GMT -5:00] AV: AVG Anti-Virus *On-access scanning enabled* (Updated) FW: ZoneAlarm Firewall *enabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\AIM6\aim6.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\VideoLAN\VLC\vlc.exe C:\WINDOWS\system32\SNDVOL32.EXE C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Neo\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Search_URL = hxxp://www.google.com/ie uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll BHO: NoExplorer - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\WCESCOMM.EXE" uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe" mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INETREPL.DLL IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INETREPL.DLL Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - c:\program files\microsoft activesync\AATP.DLL WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\CENETFLT.DLL WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\CENETFLT.DLL Notify: avgrsstarter - avgrsstx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\neo\applic~1\mozilla\firefox\profiles\kzowgget.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - plugin: c:\program files\google\update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\picasa2\npPicasa2.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll ============= SERVICES / DRIVERS =============== R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-2-20 12552] R0 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-2-21 40840] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-20 325128] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-20 27656] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-2-20 107272] R1 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-2-21 66952] R1 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-2-21 81288] R1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2009-2-24 127768] R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-2-24 394952] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-2-20 903960] R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-20 298264] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-2-21 356920] R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-2-21 1079176] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-2-24 24652] R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-2-25 38496] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2009-2-20 38560] S2 gupdate1c99473d15064c9;Google Update Service (gupdate1c99473d15064c9);c:\program files\google\update\GoogleUpdate.exe [2009-2-21 133104] S4 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2009-2-21 464264] S4 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-2-21 234888] =============== Created Last 30 ================ 2009-02-25 09:57 –d—– c:\docume~1\neo\applic~1\Malwarebytes 2009-02-25 09:57 15,504 a——- c:\windows\system32\drivers\mbam.sys 2009-02-25 09:57 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-25 09:57 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-02-25 09:57 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-02-25 08:22 –d—– c:\windows\system32\CatRoot_bak 2009-02-25 02:59 –d—– c:\windows\system32\PreInstall 2009-02-25 02:59 –d-h— c:\windows\$hf_mig$ 2009-02-25 02:24 –d—– c:\program files\ThreatExpert Memory Scanner 2009-02-25 01:57 –d—– c:\windows\system32\appmgmt 2009-02-24 23:39 –d—– c:\windows\system32\LogFiles 2009-02-24 21:18 –d—– c:\docume~1\alluse~1\applic~1\Viewpoint 2009-02-24 21:18 –d—– c:\program files\Viewpoint 2009-02-24 21:18 –d—– c:\docume~1\alluse~1\applic~1\acccore 2009-02-24 21:17 –d—– c:\program files\common files\AOL 2009-02-24 21:17 –d—– c:\program files\AIM6 2009-02-24 21:17 402 a—h— C:\IPH.PH 2009-02-24 21:13 –d—– c:\windows\system32\SoftwareDistribution 2009-02-24 20:53 2,023,456 a–sh— c:\windows\system32\drivers\fidbox.dat 2009-02-24 20:53 8,972 a–sh— c:\windows\system32\drivers\fidbox.idx 2009-02-24 20:49 4,212 —-h— c:\windows\system32\zllictbl.dat 2009-02-24 20:49 75,248 a——- c:\windows\zllsputility.exe 2009-02-24 20:49 11,264 a——- c:\windows\system32\SpOrder.dll 2009-02-24 20:48 1,086,952 a——- c:\windows\system32\zpeng24.dll 2009-02-24 20:48 –d—– c:\windows\system32\ZoneLabs 2009-02-24 20:48 –d—– c:\program files\Zone Labs 2009-02-24 20:48 352,918 a——- c:\windows\system32\vsconfig.xml 2009-02-24 20:47 –d—– c:\windows\Internet Logs 2009-02-24 20:29 –d—– c:\program files\Trend Micro 2009-02-24 20:17 –d—– c:\program files\MSECache 2009-02-23 10:35 2,464 a——- c:\windows\$_hpcst$.hpc 2009-02-23 10:35 –d—– c:\program files\AvantGo Connect 2009-02-23 10:34 –d—– c:\program files\Microsoft ActiveSync 2009-02-22 19:36 –d-h— C:\$AVG8.VAULT$ 2009-02-21 23:37 –d—– c:\program files\Yahoo! 2009-02-21 19:49 107,368 a——- c:\windows\system32\GEARAspi.dll 2009-02-21 19:49 15,464 a——- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-02-21 19:49 –d—– c:\program files\iPod 2009-02-21 19:49 –d—– c:\program files\iTunes 2009-02-21 19:49 –d—– c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2009-02-21 19:15 –d—– c:\program files\common files\Macrovision Shared 2009-02-21 18:31 –d—– c:\program files\common files\xing shared 2009-02-21 18:31 499,712 a——- c:\windows\system32\msvcp71.dll 2009-02-21 18:31 348,160 a——- c:\windows\system32\msvcr71.dll 2009-02-21 18:27 –d—– c:\program files\LSoft Technologies 2009-02-21 18:15 –d—– c:\docume~1\alluse~1\applic~1\Azureus 2009-02-21 18:15 –d—– c:\docume~1\neo\applic~1\Azureus 2009-02-21 18:15 –d—– c:\program files\AskBarDis 2009-02-21 18:14 –d—– c:\program files\Vuze 2009-02-21 18:14 –d—– c:\program files\common files\i4j_jres 2009-02-21 17:30 81,288 a——- c:\windows\system32\drivers\iksyssec.sys 2009-02-21 17:30 66,952 a——- c:\windows\system32\drivers\iksysflt.sys 2009-02-21 17:30 40,840 a——- c:\windows\system32\drivers\ikfilesec.sys 2009-02-21 17:30 29,576 a——- c:\windows\system32\drivers\kcom.sys 2009-02-21 17:30 –d—– c:\program files\Spyware Doctor 2009-02-21 17:30 –d—– c:\docume~1\neo\applic~1\PC Tools 2009-02-21 17:28 –d—– c:\temp\google 2009-02-21 17:28 –d—– C:\temp 2009-02-21 17:28 –d—– c:\windows\system32\IOSUBSYS 2009-02-21 17:28 2,560 ——– c:\windows\system32\drivers\cdralw2k.sys 2009-02-21 17:28 2,432 ——– c:\windows\system32\drivers\cdr4_xp.sys 2009-02-21 17:28 –d—– c:\program files\Picasa2 2009-02-21 17:28 –d—– c:\windows\system32\runtime 2009-02-21 17:20 –d—– c:\program files\Marvell 2009-02-20 22:50 160,401 a——- c:\windows\system32\nvapps.nvb 2009-02-20 22:49 –d—– c:\windows\system32\ReinstallBackups 2009-02-20 22:43 306,688 a——- c:\windows\IsUninst.exe 2009-02-20 22:21 –d—– c:\program files\common files\Real 2009-02-20 22:20 –d—– c:\program files\VideoLAN 2009-02-20 22:18 –d—– C:\DRIVERS 2009-02-20 22:01 12,552 a——- c:\windows\system32\drivers\avgrkx86.sys 2009-02-20 22:01 10,520 a——- c:\windows\system32\avgrsstx.dll 2009-02-20 22:01 107,272 a——- c:\windows\system32\drivers\avgtdix.sys 2009-02-20 22:01 325,128 a——- c:\windows\system32\drivers\avgldx86.sys 2009-02-20 22:01 –d—– c:\windows\system32\drivers\Avg 2009-02-20 22:01 –d—– c:\program files\AVG 2009-02-20 22:01 –d—– c:\docume~1\alluse~1\applic~1\avg8 2009-02-20 13:36 –d—– c:\windows\RegisteredPackages 2009-02-20 09:22 161,238 a——- c:\windows\system32\nvapps.xml 2009-02-20 09:22 442,368 a——- c:\windows\system32\nvudisp.exe 2009-02-20 09:22 17,937 a——- c:\windows\system32\nvdisp.nvu 2009-02-20 09:22 –d—– c:\windows\nview 2009-02-20 09:21 356,352 a——- c:\windows\system32\nvusmu.exe 2009-02-20 09:21 659 a——- c:\windows\system32\nvsmu.nvu 2009-02-20 09:21 442,368 a——- c:\windows\system32\nvusmb.exe 2009-02-20 09:21 2,016 a——- c:\windows\system32\nvsmb.nvu 2009-02-20 05:53 26,496 ac—— c:\windows\system32\dllcache\usbstor.sys 2009-02-20 05:21 38,560 a—-r– c:\windows\system32\drivers\nvhda32.sys 2009-02-20 05:21 35,840 a—-r– c:\windows\system32\nvcohda.dll 2009-02-20 05:21 442,368 a——- c:\windows\system32\nvuhda.exe 2009-02-20 05:21 354 a——- c:\windows\system32\nvhda.nvu 2009-02-20 05:20 940,794 a——- c:\windows\system32\LoopyMusic.wav 2009-02-20 05:20 146,650 a——- c:\windows\system32\BuzzingBee.wav 2009-02-20 05:20 –d—– c:\windows\system32\Lang 2009-02-20 05:20 6,400 ac—— c:\windows\system32\dllcache\splitter.sys 2009-02-20 05:20 6,400 a——- c:\windows\system32\drivers\splitter.sys 2009-02-20 05:20 553 a——- c:\windows\USetup.iss 2009-02-20 05:20 82,944 ac—— c:\windows\system32\dllcache\wdmaud.sys 2009-02-20 05:20 82,944 a——- c:\windows\system32\drivers\wdmaud.sys 2009-02-20 05:20 52,864 ac—— c:\windows\system32\dllcache\dmusic.sys 2009-02-20 05:20 52,864 a——- c:\windows\system32\drivers\DMusic.sys 2009-02-20 05:19 –d—– c:\program files\Realtek 2009-02-20 05:17 442,368 a——- c:\windows\system32\NVUNINST.EXE 2009-02-20 05:16 –d—– C:\NVIDIA 2009-02-20 05:13 –d—– c:\documents and settings\Neo 2009-02-20 05:12 –ds—- c:\windows\system32\Microsoft 2009-02-20 05:12 8,192 a——- c:\windows\REGLOCS.OLD 2009-02-20 05:11 28,288 ac—— c:\windows\system32\dllcache\xjis.nls 2009-02-20 05:09 189,440 ac—— c:\windows\system32\dllcache\smtpadm.dll 2009-02-20 05:08 –dsh— c:\documents and settings\all users\DRM 2009-02-20 05:08 –d-h— c:\program files\WindowsUpdate 2009-02-20 05:08 –d—– c:\program files\common files\MSSoap 2009-02-20 05:07 –d—– c:\program files\Online Services 2009-02-20 05:07 –d—– c:\program files\Messenger 2009-02-20 05:07 –d—– c:\program files\MSN Gaming Zone 2009-02-20 05:06 –d—– c:\program files\Windows NT 2009-02-19 22:50 –d—– c:\program files\common files\ODBC 2009-02-19 22:50 –d—– c:\program files\common files\SpeechEngines 2009-02-19 22:50 –d–r– c:\documents and settings\all users\Documents ==================== Find3M ==================== 2009-02-20 05:41 86,327 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2009-02-20 05:07 21,640 a——- c:\windows\system32\emptyregdb.dat 2008-12-09 04:06 282,624 a——- c:\windows\system32\ykx32mpcoinst.dll ============= FINISH: 10:23:57.81 ===============

Attachments:

Post #4
Your logs look fine, are you having any other problems other than these cookies?

This is Firefox? You can change your settings for accepting cookies by clicking Tools >> Options >> Privacy. I recommend that Accept Third Party Cookies should be unchecked, and I personally have the whole thing set to Ask Me Every Time so I know I am only getting cookies that I want. This may seem like a pain to start with but once you have been surfing a while you would have Allowed (with "Remember my answer for this site" checked) most of the cookies from the legit sites and things should be ok.

Cheers.
Post #5
thank you very much for your quick response and help. im annoyied to the fact that this is a brand new barebone PC and i am already having infections. it was my mistake from downloading movies and other stuff, but SOPCAST i think it s the reason why i got infected. did u ever hear about this happening before? i got a page that will pop up everytime i wanted to watch a futbol game or show. the problem is that i will close that window (the advertising) and another will pop up again. what should i do if ZONE ALARM gives me a list of 30 or so cookies and 1 trojan and its not DELETING them, why is that? why i cant kill those bastards? im frustrated. i want to thank you once again for all your support and help and if i see something even worst than this problems I will make sure to return for your guidance. cheers Alex
Post #6
I'm not familiar with SOPCAST and problems relating to it but it wouldn't surprise me if it came with advertising like that - these things often do.

Your cookies are most likely being picked up from third party advertising websites while you surfing. I don't believe you have an infection resident on your machine. They will keep coming back as soon as you surf the internet and one of the ad sites is involved in some way. This is why I suggested you take a look at your cookie settings, to try and prevent them.

If you are also using IE then you can change its cookie settings by clicking Tools >> Internet Options >> Privacy.

These "tracking cookies" aren't usually Malware as such, they are just considered as unwanted items by Anti-Spyware programs.

Thanks.
Post #7
understood. thank you. i guess i will have to live with the fact that i cant remove those cookies. peace and thank you very much, u been very kind. take care and have a great day alex
Post #8
Well, you should be able to get rid of them with ATF-Cleaner (hit the Firefox tab at the top). Its the prevention that's they key part. You can also delete your cookies manually from within Firefox, by going back to the "Privacy" tab I mentioned, clicking Show Cookies and the Remove All Cookies.

Hope that helps.
Post #9
i did everything as you told me and i even deleted 3 times the cookies on Firefox but PC Tools Spyware Doctor keeps finding: Adware.Advertising (lv cache trafficmp.com) AVG log is now totally clean. thank you
Post #10
Can SpywareDoctor remove it? Does it give a file location? You can clear Firefox's cache either from ATF-Cleaner again or "Clear Private Data" from the Privacy tab on the options screen.
Post #11
Spyware Doctor will remove it but later on after few minutes of surfing the net the Adware.Advertising will reappear. over and over again. it doesnt give me a location. i used the ATF and Clean Private Data. is it possible that i am being attack because i use: Azureus, AIM, Yahoo Messenger, Bonjour Service (?), or Treat Expert Memory Scanner? (those are some of the names that appear on my Zone Alarm with Access/Server attributes. which one should have Trusted/Internet attributes at Zone Alarm? as today I only gave Azureus the Server-internet privilege. im clueless because i want to have a safe computer but at the same time i like to use Azureus to download data. thank you again a.
Post #12
Well, there are always risks with P2P programs like Azureus as you have no idea where the stuff you are downloading is coming from and who could have messed with it.

Have you heard of/used an extension called AdBlockPlus for Firefox? Its a great extensions to have in my opinion as it blocks pretty much all third-party advertising.

I don't think you are under any sort of attack. On the SpywareDoctor website there is a description of the infection it keeps picking up:

Advertising companies store cookies on a user's computer to serve targeted ads based on the web surfers interests when visiting a website serving their ads.


Its nothing serious, just an "unnecessary item".
Post #13
well i just added what you suggested and i will be using it. thank you very much and take care if the adware/cookies that i have on my system are harmless i can live with that. peace…. have a great day and thanks again for all your help a.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI