This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] (very) infected

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

help (very) appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:25:55 PM, on 8/2/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Unable to get Internet Explorer version!
Boot mode: Safe mode

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\userinit.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrsrv.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.iupxqdkmpwkatollte.com/i7uUViej…tWweFMydYwx.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qing.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/customi…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 142.101.36.11 cgodcwq002
O1 - Hosts: 142.101.36.13 cgodcwqa02
O1 - Hosts: 142.101.36.5 cgblrwa006
O1 - Hosts: 142.101.36.7 siodcsa002 cgblrsa002
O1 - Hosts: 142.101.36.31 cgblrsq001
O1 - Hosts: 142.101.36.5 CGBLRWA006
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SpamBlockerUtility - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbHostIE.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Windows] system.exe
O4 - HKCU\..\Run: [System Soap Pro] C:\Program Files\System Soap Pro\soap.exe min
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1136067077312
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} (SbInstObj) - http://installs.spamblockerutility.com/ins…ckerutility.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.workstreaminc.com/workspace/xpdesk/msrdp.cab
O16 - DPF: {94B6A838-7EA3-4C3C-B768-D260DDD685B6} (GetFQDN.ctlTrace) - http://www.rogershelp.com/help/content/how…ork/getfqdn.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B7E76C25-791F-432E-BDB7-748D01A93FC2} (VacPro.int_ver30) - http://advnt01.com/dialer/int_ver30.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://sera-mtl.cgi.com/dana-cached/setup/…perSetupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CAEBDD1-6BEC-4317-9DD3-735D0102D660}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: OracleORA817Agent - Unknown owner - c:\oracle\oracle817\bin\dbsnmp.exe (file missing)
O23 - Service: OracleORA817ClientCache - Unknown owner - c:\oracle\oracle817\BIN\ONRSD.EXE (file missing)
O23 - Service: OracleORA817DataGatherer - Unknown owner - c:\oracle\oracle817\bin\vppdc.exe (file missing)
O23 - Service: OracleORA817HTTPServer - Unknown owner - c:\oracle\oracle817\Apache\Apache\Apache.exe (file missing)
O23 - Service: OracleORA817PagingServer - Unknown owner - c:\oracle\oracle817/bin/pagntsrv.exe (file missing)
O23 - Service: OracleORA817TNSListener - Unknown owner - c:\oracle\oracle817\BIN\TNSLSNR.exe (file missing)
O23 - Service: OracleServiceRC01 - Unknown owner - c:\oracle\oracle817\bin\ORACLE.EXE (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe
O23 - Service: VNC Server (winvnc) - Constantin Kaplinsky - C:\Program Files\TightVNC\WinVNC.exe

–
End of file - 8346 bytes

——————————-

-slow browsing & ad links cover some search results
-SERVICES.EXE insists on connecting to both primary and secondary DNS (normal?)
-"SysFader" hangs during shutdown
-nortons wont launch, getting the error msg "unable to start the integrator, please reboot and blah blah blah" yet Lucoms~1.exe and LuCallbackProxy.exe seem to run every time i end a process………
-avgrsx running as process but not in tray (and eating up looooots of mem..)
-possibly the strangest of all….. windows decided all of a sudden that i need to start entering my password at startup again (huh?)
-the list goes on

spybot and avg find nothing
firewall = zonealarm

this is i find hard to believe: service pack 4 IS the most recent for win2k? most recent security pack IS from 2004? really? am i at risk using 2k?


THANK YOU! in advance

this is i find hard to believe: service pack 4 IS the most recent for win2k? most recent security pack IS from 2004? really? am i at risk using 2k?

Yes, Yes and Yes.

[external image: Posted Image]


DO NOT use any TOOLS such as Combofix, SmitfraudFix, MBAM, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.




Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

In Windows 98/Me/2000, on the Windows desktop, double-click the My Computer icon.
In Windows Me/2000/XP, on the Tools menu, click Folder Options.
Under the "Hidden files" folder, select "Show hidden files and folders."
On the View tab, Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
[external image: Posted Image]
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste". .
oh..no..

blue screen normal start:

***STOP: 0x000000CE (0xED2A30BC, 0x00000000, 0xED2A30BC, 0x00000000)
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS. this driver may be at fault : viaagpl.sys

***Address ED2A30BC base at ED2A0000, DataStamp 00000000 - viaagpl.sys
***Address ED2A30BC base at ED2A0000, DataStamp 00000000 - viaagpl.sys

blue screen safe start:

***STOP: 0x00000050 (0xED2A30BC, 0x00000000, 0xED2A30BC, 0x00000000)
PAGE _FAULT_IN_NONPAGED_AREA

***Address ED2A30BC base at ED2A0000, DataStamp 00000000 - viaagpl.sys
***Address ED2A30BC base at ED2A0000, DataStamp 00000000 - viaagpl.sys


i'm on a 2nd computer
..awaiting response..
Well that's the default video driver I believe.

If it won't boot at all, I'm not sure what to tell you here in the Malware Forum.
You could start a new topic in or Windows Forum and make sure you let them know you're using W2K.
back up and running on old registry can you tell why this happened? why would mb target a video driver of all things? —————————————————– Malwarebytes' Anti-Malware 1.39 Database version: 2548 Windows 5.0.2195 Service Pack 4 8/2/2009 7:55:18 PM mbam-log-2009-08-02 (19-55-18).txt Scan type: Quick Scan Objects scanned: 84483 Time elapsed: 16 minute(s), 5 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 94 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 44 Files Infected: 299 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\hbcoresrv.dynamicprop (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbcoresrv.dynamicprop.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbcoresrv.coreservices (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbcoresrv.coreservices.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbcoresrv.lfgax (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbcoresrv.lfgax.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbhostol.mailanim (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbhostol.mailanim.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbhostol.webmailsend (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbhostol.webmailsend.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbinstie.sbinstobj (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbinstie.sbinstobj.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbsrv.coreservices (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbsrv.coreservices.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbtoolbar.htmlmenuui (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbtoolbar.htmlmenuui.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbtoolbar.toolbarctl (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sbtoolbar.toolbarctl.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\spamblockerconfig.application (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\spamblockerconfig.application.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\spamblockerutility.commband (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\spamblockerutility.commband.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\spamblockerutility.sbmain (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\spamblockerutility.sbmain.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{023a4648-601a-4c30-8a2e-c72ebfa99af6} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{175816a5-219e-4079-b2f9-53c501c409ba} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{19ebcbe0-9245-4397-bc5d-883d34782043} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{27c4569f-8728-4958-a920-a607cae8153c} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{38370864-346f-4afa-8c4b-4fbff518c0bb} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{397a208b-3d09-4b3e-93e8-ca171886612e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3c1a06cc-3981-4db9-b5b6-b4b8ecb1d7f2} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{421745e9-16df-4ee4-a758-d51f939c49cb} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{4331ec56-0aab-499e-8757-dd2ee44ad671} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{54286c3a-e044-4e65-bd44-528d6ae28a18} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{5d16197a-1eaa-45af-b29a-69f1aa055e87} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{5f2b9de7-f878-4762-8cfe-e9c58f082f0e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{8654592e-952a-4e7c-a960-304763b35fa6} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{8a61a950-c325-4f44-ba64-273180ff3464} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{8d5c4ec6-af8e-4b85-ba27-64babe410510} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{8e98faf8-794f-47f9-af90-15305564ed81} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{af15975b-1498-4740-8e6c-90af78e4198c} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b53d4cd4-406d-43cc-8244-7893d72236dd} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b9bb3219-f84c-4060-966b-4a1e73e24226} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{bc8c2e5f-d8b4-4997-bce3-8775c3707956} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d082721f-4bd4-4b8b-bb82-06753ee6174f} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d24f9d3c-5d4c-47f8-9ab7-632b44ad6a0d} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f43ec88b-b6c8-4969-a763-e2bf55602cce} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f786cb18-3809-4e49-bc99-9a66da47db8b} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f814be58-1bf9-4b50-829a-e889f86127ad} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{00b498e3-0543-4624-8fde-1caf89a80550} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0ab71193-ec19-4d70-85c2-e46e2ff02755} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1e0004ec-5df0-48c7-a8f0-fbb0488a3d94} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{31a59636-0fa3-4a56-954d-db7ad02840d8} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3fa917b9-df69-477f-9e4f-b60d929de79f} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{420c35c9-e4f2-49f9-bf67-2be1ecf86989} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{460ac4db-b0de-4626-a0f0-175dd84dcb9b} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7e66936c-fea0-4984-ad26-7b6661ac5b2e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8c875948-9c60-4381-9248-0df180542d53} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a14c0d8d-e753-4e73-9e2b-4070791d8940} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c2baa4c9-ae1e-4605-ae2f-a1c49a30d881} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e678cbdc-d022-41f5-ab21-c43dfd9dfc3e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ea232a0a-46f8-4d44-a30b-50321518a828} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ed8525ea-2bfc-4440-bd8a-20efb9d5e541} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{fa16bce1-5e36-472a-8466-e0cdd5ce00e6} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{45397063-d7d0-47c2-9508-26487608a298} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{4cf5a3c1-07a2-4336-9b54-6870452ebde1} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{71e9cf40-af72-4b55-bd3f-1fea2a0eaea6} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{71efe583-62fe-4419-9918-ca3b683f7b36} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{9967a873-40f3-4c7e-9239-6c8760f19f61} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{b9f51d42-cca0-4408-bb02-d433d1865a3a} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8c875948-9c60-4381-9248-0df180542d53} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{7e66936c-fea0-4984-ad26-7b6661ac5b2e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{7e66936c-fea0-4984-ad26-7b6661ac5b2e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{354382db-df55-4da9-85a3-41696a0f510f} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{5ba32d9e-f1bd-476c-ad42-97c9379a57a4} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{20d21e02-8c1c-41fe-9826-dab4c223436c} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{66291bef-c867-43c0-a7b4-d13393814bcd} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{175652e8-8bcc-47c4-b591-0d630f469c19} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{40d8240a-e3a0-4d59-ac55-0443120188d1} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{bce2e826-d0f5-41c8-97be-28a6f540ceeb} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{21447c90-6ec1-4fc1-9379-bd515008aedb} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{32c97a37-e2b8-4097-9330-5f3e1125e181} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b0c3de1b-e3ff-4dd0-9229-f452cf9c678e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d2d94732-a74d-433c-98f7-9ed740e82ae9} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{dfd5d79b-ef2f-4a51-9821-5b469f05262e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{286e500c-ef0a-4aa3-a94d-e495f653ef4b} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{319260ab-be0c-4025-8569-7a27ed2faab9} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8ac5bc54-b13b-4642-99f9-0baa2d116184} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9809a6b4-70b1-4bb2-b3b5-b415763a534e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d5178f77-c5e6-4e8f-9787-48b5d7eccce8} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\SpamBlockerUtility (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\sbtv (Adware.Hotbar) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\spamblockerutility 4.8.4 (Adware.Hotbar) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\SpamBlockerUtility (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SBTV (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Documents and Settings\Mine\Application Data\SpamBlocker (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\SpamBlockerUtility (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\IESkins (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\SpamBlockerUtility (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\spamblockerutility\static (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\spamblockerutility\static\1 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\spamblockerutility\static\2 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\spamblockerutility\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\HostOL (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\HostOL\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\HostOI (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\administrator\application data\spamblockerutility\v3.0\HostOI\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Documents and Settings\Mine\Application Data\SpamBlockerUtility (Adware.Hotbar) -> Delete on reboot. c:\documents and settings\Mine\application data\spamblockerutility\v3.0 (Adware.Hotbar) -> Delete on reboot. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\SpamBlockerUtility (Adware.Hotbar) -> Delete on reboot. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\dynamic (Adware.Hotbar) -> Delete on reboot. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\dynamic (Adware.Hotbar) -> Files: 672 -> Delete on reboot. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\ustat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\TooltipXML (Adware.Hotbar) -> Delete on reboot. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\TooltipXML (Adware.Hotbar) -> Files: 2217 -> Delete on reboot. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\344stat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOL (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOL\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOL\static (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOI (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOI\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOI\static (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOI\static\DownLoad (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOI\static\1 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\HostOI\static\2 (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\IESkins (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\eskin (Adware.Hotbar) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\SpamBlockerUtility\bin\4.8.4.0\SBClientSinkPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Program Files\SpamBlockerUtility\bin\4.8.4.0\SBTrayAppPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Program Files\SpamBlockerUtility\bin\4.8.4.0\SBSrvPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1121977569.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1122500069.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1123107612.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1123629245.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1124147857.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1124604119.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1125170027.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1125893525.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1126969817.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1128219641.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1129161386.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1130187540.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1131031511.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1132011826.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1132874343.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1133887655.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1135386222.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1136485673.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1137865116.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1139450388.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1140324143.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1141371439.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1143071249.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1144445332.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1145300848.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1146968173.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1147849208.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1148342563.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1149467047.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility_1152828802.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SpamBlockerUtility.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\SbUninst.exe (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\dBenderC.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\1_Trash.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\2_Balloon.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\3_Shot Gun.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\ASAPCom.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\Redemption.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SBClientSinkPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SbCoreSrv.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SbHostIE.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SbHostOL.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SBInst.exe (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SBOLExp.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SBOLExt.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SBSrvPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SbToolbar.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SBTrayAppPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SBUIRes.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SBUISkin.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SbWallpaper.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.6.1.0\SpamBlocker.exe (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\dBenderC.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\1_Trash.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\2_Balloon.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\3_Shot Gun.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\ASAPCom.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\Contact.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\Redemption.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SBClientSinkPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SbCoreSrv.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SBInst.exe (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SBOLExp.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SBOLExt.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SbSrv.exe (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SBSrvPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SbToolbar.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SBTrayAppPS.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SBUIRes.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SBUISkin.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SbWallpaper.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.0.0\SpamBlocker.exe (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\dBenderC.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\1_Trash.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\2_Balloon.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\3_Shot Gun.wav (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\ASAPCom.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\Redemption.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\SBInst.exe (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\SBOLExp.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\SBOLExt.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\SBUIRes.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\SBUISkin.dll (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\bin\4.8.4.0\SpamBlocker.exe (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SBTV\sbtv_gdf.dat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SBTV\sbtv_kyf.dat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\program files\spamblockerutility\SBTV\sbtvau.dat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1158615025.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1164680250.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1172455009.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1179813241.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1182517417.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1186431629.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1190852212.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1194979468.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1200019330.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1203866160.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1207860248.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility_1211832150.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\SpamBlockerUtility.log (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_Games.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_Hide.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_Hotmail.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_Mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_SearchBoxTrapper.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz1.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz10.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz11.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz12.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz13.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz14.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz15.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz16.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz17.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz18.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz19.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz2.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz20.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz3.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz4.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz5.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz6.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz7.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz8.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz9.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_categorize.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_comparison.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_em_PROFL_CA_flow_b_IEB.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_explorer-Mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_explorer-people.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_fastutilities.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_favorites.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_hotbarcom.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_hsskin.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\ads.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\btntrans.idx (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\keywords_idx.idx (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\keywords_sdf.sdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_jemster.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_jemsterie.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_jemsteruk.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_jobsearch.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_new.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_reun.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_ringtones.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_searchfor.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_searchgo.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_weather.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_yellowpages.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Top7_theweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\btntrans1.dat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\business_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\buttondir.txt (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\components.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\cursors.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_1000.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_2000.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_3000.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_bar.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_bbar1.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_logos.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_other.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_weather.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\default.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\email-def-511724-9595.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\email-t1-bg.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\hb_ie_menu.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\hotbar-premium-hotbar-premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\hotbar-premium.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\hotbar_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\icons2.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\ie_games_icon.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\ie_video.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\keywords.idx (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\keywords1.dat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\layout.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\linkpathlegal.txt (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\progress.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\s_icons_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\sales_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\sbu_icon.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\t2_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\theweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\top7.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\tsd_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\1\weathericon.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_Games.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_Hide.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_Hotmail.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_Mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_SearchBoxTrapper.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz1.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz10.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz11.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz12.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz13.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz14.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz15.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz16.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz17.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz18.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz19.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz2.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz20.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz3.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz4.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz5.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz6.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz7.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz8.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_bidz9.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\ads.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar10.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar11.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar12.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar13.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar14.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar2.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar3.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar4.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar5.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar6.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar7.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar8.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar9.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_categorize.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_comparison.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_x.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_em_PROFL_CA_flow_b_IEB.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_explorer-Mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_explorer-people.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_fastutilities.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_favorites.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_hotbarcom.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_hsskin.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_jemster.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_jemsterie.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_jemsteruk.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_jobsearch.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_new.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_reun.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_ringtones.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_searchfor.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_searchgo.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_weather.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Default_yellowpages.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\Top7_theweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\btntrans.idx (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\btntrans1.dat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\business_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\buttondir.txt (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\components.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\cursors.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_1000.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_2000.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_3000.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bar.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_bbar1.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_logos.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_buttons_other.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\d_icons_weather.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\default.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\email-def-511724-9595.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\email-t1-bg.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\hb_ie_menu.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\hotbar-premium-hotbar-premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\hotbar-premium.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\hotbar_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\icons2.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\ie_games_icon.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\ie_video.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\keywords.idx (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\keywords1.dat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\layout.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\linkpathlegal.txt (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\progress.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\s_icons_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\sales_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\sbu_icon.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\t2_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\theweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\top7.cdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\tsd_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\weathericon.res (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\keywords_idx.idx (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\static\2\keywords_sdf.sdf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\ustat\36f6.dat (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\eskin\empty_bg_st.htm (Adware.Hotbar) -> Quarantined and deleted successfully. c:\documents and settings\Mine\application data\spamblockerutility\eskin\FileManager.txt (Adware.Hotbar) -> Quarantined and deleted successfully. C:\WINNT\didduid.ini (Fake.Dropped.Malware) -> Quarantined and deleted successfully. c:\WINNT\downloaded program files\SpamBlockerUtility.inf (Adware.Hotbar) -> Quarantined and deleted successfully. c:\WINNT\smdat32m.sys (Rootkit.Agent) -> Quarantined and deleted successfully. (another hjt log to follow)
pls note that the above registry changes made by malwarebytes have been reversed during registry restore.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:50:02 AM, on 8/3/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Unable to get Internet Explorer version!
Boot mode: Safe mode

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\userinit.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrsrv.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.iupxqdkmpwkatollte.com/i7uUViej…tWweFMydYwx.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qing.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/customi…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 142.101.36.11 cgodcwq002
O1 - Hosts: 142.101.36.13 cgodcwqa02
O1 - Hosts: 142.101.36.5 cgblrwa006
O1 - Hosts: 142.101.36.7 siodcsa002 cgblrsa002
O1 - Hosts: 142.101.36.31 cgblrsq001
O1 - Hosts: 142.101.36.5 CGBLRWA006
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SpamBlockerUtility - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbHostIE.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Windows] system.exe
O4 - HKCU\..\Run: [System Soap Pro] C:\Program Files\System Soap Pro\soap.exe min
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1136067077312
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.workstreaminc.com/workspace/xpdesk/msrdp.cab
O16 - DPF: {94B6A838-7EA3-4C3C-B768-D260DDD685B6} (GetFQDN.ctlTrace) - http://www.rogershelp.com/help/content/how…ork/getfqdn.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B7E76C25-791F-432E-BDB7-748D01A93FC2} (VacPro.int_ver30) - http://advnt01.com/dialer/int_ver30.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://sera-mtl.cgi.com/dana-cached/setup/…perSetupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CAEBDD1-6BEC-4317-9DD3-735D0102D660}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: OracleORA817Agent - Unknown owner - c:\oracle\oracle817\bin\dbsnmp.exe (file missing)
O23 - Service: OracleORA817ClientCache - Unknown owner - c:\oracle\oracle817\BIN\ONRSD.EXE (file missing)
O23 - Service: OracleORA817DataGatherer - Unknown owner - c:\oracle\oracle817\bin\vppdc.exe (file missing)
O23 - Service: OracleORA817HTTPServer - Unknown owner - c:\oracle\oracle817\Apache\Apache\Apache.exe (file missing)
O23 - Service: OracleORA817PagingServer - Unknown owner - c:\oracle\oracle817/bin/pagntsrv.exe (file missing)
O23 - Service: OracleORA817TNSListener - Unknown owner - c:\oracle\oracle817\BIN\TNSLSNR.exe (file missing)
O23 - Service: OracleServiceRC01 - Unknown owner - c:\oracle\oracle817\bin\ORACLE.EXE (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe
O23 - Service: VNC Server (winvnc) - Constantin Kaplinsky - C:\Program Files\TightVNC\WinVNC.exe

–
End of file - 8182 bytes
Download Dr.Web CureIt to the desktop:
  • Doubleclick the drweb-cureit icon to start the program.
  • press start
  • Allow the program to run the initial express scan
  • This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
    Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
  • Once the scan is complete, the results will be displayed
  • on the menu bar, click file and choose report list.
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
  • Close Dr.Web Cureit.
  • Please post the Dr.Web.txt report in your next reply

Reboot the computer in Normal Mode,
Post the Cure-it report and a fresh HijackThis log
!! will only connect to the internet when linked through router, modem to box simply doesn't work.. same with the other machine on the router, which i've isolated. it was probably the root of our virus (used for browsing).

i can give you a shot of my zonealarm log if it helps, but from startup, services.exe makes or tries to make 20+ outgoing connections or data transfers before i have time to scratch my ass. some make it some don't, seems to be up to zonealarm. i'm using the highest setting that the free version allows.. can you recommend any additional security software that wont slow me down further?

download speeds and browsing can get so bogged down that, at the time, i wasn't even able to dl drwebcureit :S latency is unaffected.

drwebcureit log:
soap.exe;c:\program files\system soap pro;Probably BACKDOOR.Trojan;; "an old history and log cleaner that won't load or uninstall"
vnchooks.dll;c:\program files\tightvnc;Program.RemoteAdmin;; "unused remote access program"
winvnc.exe;c:\program files\tightvnc;Program.RemoteAdmin;; "what's the best way to clean this out"

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:43:53 AM, on 8/5/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\HPZipm12.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrsrv.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\System Soap Pro\soap.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.iupxqdkmpwkatollte.com/i7uUViej…tWweFMydYwx.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qing.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/customi…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 142.101.36.11 cgodcwq002
O1 - Hosts: 142.101.36.13 cgodcwqa02
O1 - Hosts: 142.101.36.5 cgblrwa006
O1 - Hosts: 142.101.36.7 siodcsa002 cgblrsa002
O1 - Hosts: 142.101.36.31 cgblrsq001
O1 - Hosts: 142.101.36.5 CGBLRWA006
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SpamBlockerUtility - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbHostIE.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Windows] system.exe
O4 - HKCU\..\Run: [System Soap Pro] C:\Program Files\System Soap Pro\soap.exe min
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1136067077312
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.workstreaminc.com/workspace/xpdesk/msrdp.cab
O16 - DPF: {94B6A838-7EA3-4C3C-B768-D260DDD685B6} (GetFQDN.ctlTrace) - http://www.rogershelp.com/help/content/how…ork/getfqdn.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B7E76C25-791F-432E-BDB7-748D01A93FC2} (VacPro.int_ver30) - http://advnt01.com/dialer/int_ver30.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://sera-mtl.cgi.com/dana-cached/setup/…perSetupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CAEBDD1-6BEC-4317-9DD3-735D0102D660}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: OracleORA817Agent - Unknown owner - c:\oracle\oracle817\bin\dbsnmp.exe (file missing)
O23 - Service: OracleORA817ClientCache - Unknown owner - c:\oracle\oracle817\BIN\ONRSD.EXE (file missing)
O23 - Service: OracleORA817DataGatherer - Unknown owner - c:\oracle\oracle817\bin\vppdc.exe (file missing)
O23 - Service: OracleORA817HTTPServer - Unknown owner - c:\oracle\oracle817\Apache\Apache\Apache.exe (file missing)
O23 - Service: OracleORA817PagingServer - Unknown owner - c:\oracle\oracle817/bin/pagntsrv.exe (file missing)
O23 - Service: OracleORA817TNSListener - Unknown owner - c:\oracle\oracle817\BIN\TNSLSNR.exe (file missing)
O23 - Service: OracleServiceRC01 - Unknown owner - c:\oracle\oracle817\bin\ORACLE.EXE (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe
O23 - Service: VNC Server (winvnc) - Constantin Kaplinsky - C:\Program Files\TightVNC\WinVNC.exe

–
End of file - 8865 bytes

thanks again!
The modem could be bad.

Lets see if CF will find anything.

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Note: Combofix will run without the Recovery Console installed.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.
ComboFix 09-08-06.01 - Mine 08/07/2009 0:30.1.1 - FAT32x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 32A


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\winnt\Downloaded Program Files\temp
c:\winnt\system32\Drivers\glkvy.sys
c:\winnt\system32\msconfig.exe
c:\winnt\Web\default.htt




.
((((((((((((((((((((((((( Files Created from 2009-07-07 to 2009-08-07 )))))))))))))))))))))))))))))))
.

2009-08-07 04:27 . 2009-08-07 04:27 16384 —-a-w- c:\winnt\system32\Perflib_Perfdata_390.dat
2009-08-04 22:15 . 2009-08-04 22:15 ——– d—–w- c:\documents and settings\Mine\DoctorWeb
2009-08-02 23:30 . 2009-08-02 23:30 ——– d—–w- c:\documents and settings\Mine\Application Data\Malwarebytes
2009-08-02 23:30 . 2009-07-13 17:36 38160 —-a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-08-02 23:30 . 2009-08-02 23:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-02 23:30 . 2009-07-13 17:36 18456 —-a-w- c:\winnt\system32\drivers\mbam.sys
2009-08-02 23:30 . 2009-08-02 23:30 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-02 18:06 . 2009-08-02 18:06 ——– d—–w- c:\program files\Trend Micro
2009-08-02 17:52 . 2009-08-02 17:52 ——– d—–w- c:\program files\ERUNT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-05 05:37 . 2005-07-02 01:13 90392739 ——w- c:\winnt\Internet Logs\tvDebug.zip
2009-08-02 23:58 . 2009-08-02 23:58 130448 —-a-w- c:\program files\spop.txt
2009-08-01 02:13 . 2005-06-25 00:23 5882 —-a-w- c:\winnt\mozver.dat
2009-07-05 07:19 . 2009-04-07 02:55 9223 —-a-w- c:\program files\V1.00 Server Spy.htm
2009-06-02 14:13 . 2009-06-03 02:48 93696 ——w- c:\winnt\Internet Logs\xDBA.tmp.tmp
2009-05-26 03:25 . 2009-05-26 03:27 483840 ——w- c:\winnt\Internet Logs\xDB9.tmp.tmp
2003-05-31 18:28 . 2003-05-31 18:28 21952 —h–w- c:\program files\folder.htt
2004-05-13 20:55 . 2004-05-13 20:55 32 –sha-w- c:\winnt\{E906FC91-51AE-459B-9307-4AA73C93FC3A}.dat
2004-05-16 12:07 . 2004-05-16 12:07 32 –sha-w- c:\winnt\{BA199FD0-4A99-4C55-8784-791E153FA339}.dat
2004-05-13 20:55 . 2004-05-13 20:55 32 –sha-w- c:\winnt\system32\{17FDD14E-9F3D-47B5-9BDF-9C78E0693BCD}.dat
2004-05-16 12:07 . 2004-05-16 12:07 32 –sha-w- c:\winnt\system32\{0A7FF37C-F7F7-4F51-8F7F-79A59110567F}.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-14 919016]
"Synchronization Manager"="mobsync.exe" - c:\winnt\system32\mobsync.exe [2003-06-19 111376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2003-06-19 186640]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\winnt\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Cisco Systems VPN Client.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk
backup=c:\winnt\pss\Cisco Systems VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\winnt\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\winnt\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\winnt\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=c:\winnt\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\winnt\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\winnt\pss\Picture Package Menu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\winnt\pss\Picture Package VCD Maker.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Mine^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Mine\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\winnt\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NVSvc"=2 (0x2)
"iPodService"=3 (0x3)
"Adobe LM Service"=3 (0x3)
"RioMSC"=2 (0x2)
"Bonjour Service"=2 (0x2)
"BITS"=3 (0x3)

R0 SONYPVM1;Sony Memory Stick Driver(SONYPVM1);c:\winnt\system32\drivers\SonyPVM1.sys [1/1/2005 6:09 PM 28224]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winnt\system32\drivers\avgldx86.sys [7/10/2008 7:41 AM 97928]
R1 cdudf;cdudf;c:\winnt\system32\drivers\Cdudf.sys [5/17/2001 3:28 PM 363151]
R1 NEOFLTR_600_12507;Juniper Networks TDI Filter Driver (NEOFLTR_600_12507);c:\winnt\system32\drivers\NEOFLTR_600_12507.sys [12/27/2007 11:23 PM 64160]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/10/2008 7:41 AM 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/10/2008 7:41 AM 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\winnt\system32\drivers\avgtdix.sys [7/10/2008 7:41 AM 76040]
R3 als4k;AOpen AW200/AS9200 Sound Driver (WDM);c:\winnt\system32\drivers\als4000.sys [5/31/2003 3:43 PM 31623]
R3 ALS4KMF;ALS4KMF;c:\winnt\system32\drivers\mf.sys [8/14/2003 12:30 PM 57264]
R3 alsgame;Gameport for AOpen AW200/AS9200;c:\winnt\system32\drivers\alsgame.sys [5/31/2003 3:42 PM 9981]
R3 Eacfilt;Eacfilt Miniport;c:\winnt\system32\drivers\eacfilt.sys [3/18/2008 7:45 PM 11001]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\winnt\system32\drivers\ipsecw2k.sys [3/18/2008 7:45 PM 148688]
S3 OracleORA817Agent;OracleORA817Agent;c:\oracle\oracle817\bin\dbsnmp.exe –> c:\oracle\oracle817\bin\dbsnmp.exe [?]
S3 OracleORA817ClientCache;OracleORA817ClientCache;c:\oracle\oracle817\BIN\ONRSD.EXE –> c:\oracle\oracle817\BIN\ONRSD.EXE [?]
S3 OracleORA817DataGatherer;OracleORA817DataGatherer;c:\oracle\oracle817\bin\vppdc.exe –> c:\oracle\oracle817\bin\vppdc.exe [?]
S3 OracleORA817HTTPServer;OracleORA817HTTPServer;c:\oracle\oracle817\Apache\Apache\Apache.exe –> c:\oracle\oracle817\Apache\Apache\Apache.exe [?]
S3 OracleORA817PagingServer;OracleORA817PagingServer;c:\oracle\oracle817/bin/pagntsrv.exe –> c:\oracle\oracle817/bin/pagntsrv.exe [?]
S3 OracleORA817TNSListener;OracleORA817TNSListener;c:\oracle\oracle817\BIN\TNSLSNR –> c:\oracle\oracle817\BIN\TNSLSNR [?]
S3 OracleServiceRC01;OracleServiceRC01;c:\oracle\oracle817\bin\ORACLE.EXE RC01 –> c:\oracle\oracle817\bin\ORACLE.EXE RC01 [?]
S3 viafilter;VIA USB Filter;c:\winnt\system32\drivers\viausb.sys [5/31/2003 3:12 PM 9038]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{DA1801AA-2ED3-4064-95CB-DF1919288DC1} - (no file)
WebBrowser-{77F89CA4-6CF1-4BFE-B4FA-AAF5EFD0B061} - (no file)
WebBrowser-{25E04CE5-6DAA-488A-A633-B46264DE73ED} - (no file)
WebBrowser-{5A769E93-B547-41B3-A9F4-A64F6F04B59D} - (no file)
WebBrowser-{559A1476-C9EB-DA7F-06BD-1405028D93FE} - (no file)
HKLM-Run-MSConfig - c:\winnt\system32\msconfig.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://qing.com/
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://ca.red.clientapps.yahoo.com/customize/rogers/defaults/su/*http://www.yahoo.com
IE: c:\progra~1\COMMON~1\BTLINK\btlink.dll//iemenu
LSP: %SystemRoot%\system32\msafd.dll
TCP: {5CAEBDD1-6BEC-4317-9DD3-735D0102D660} = 208.67.222.222,208.67.220.220
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} -
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {94B6A838-7EA3-4C3C-B768-D260DDD685B6} - hxxp://www.rogershelp.com/help/content/how/home_network/getfqdn.cab
FF - ProfilePath - c:\documents and settings\Mine\Application Data\Mozilla\Firefox\Profiles\0ukyr8dx.Sezmo\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npq3px.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-07 00:44
Windows 5.0.2195 Service Pack 4 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\OracleORA817PagingServer]
"ImagePath"="c:\oracle\oracle817/bin/pagntsrv.exe"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\OracleORA817TNSListener]
"ImagePath"="c:\oracle\oracle817\BIN\TNSLSNR "
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(220)
c:\winnt\system32\avgrsstx.dll
c:\winnt\system32\wzcdlg.dll
c:\winnt\system32\WZCSAPI.DLL

- - - - - - - > 'lsass.exe'(268)
c:\winnt\system32\avgrsstx.dll
.
Completion time: 2009-08-07 0:46
ComboFix-quarantined-files.txt 2009-08-07 04:46

Pre-Run: 4,690,984,960 bytes free
Post-Run: 4,677,861,376 bytes free

215


*****************************************************************************
*****************************************************************************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:16:06 AM, on 8/7/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\HPZipm12.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrsrv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qing.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/customi…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 142.101.36.11 cgodcwq002
O1 - Hosts: 142.101.36.13 cgodcwqa02
O1 - Hosts: 142.101.36.5 cgblrwa006
O1 - Hosts: 142.101.36.7 siodcsa002 cgblrsa002
O1 - Hosts: 142.101.36.31 cgblrsq001
O1 - Hosts: 142.101.36.5 CGBLRWA006
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINNT\system32\msconfig.exe /auto
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1136067077312
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.workstreaminc.com/workspace/xpdesk/msrdp.cab
O16 - DPF: {94B6A838-7EA3-4C3C-B768-D260DDD685B6} (GetFQDN.ctlTrace) - http://www.rogershelp.com/help/content/how…ork/getfqdn.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://sera-mtl.cgi.com/dana-cached/setup/…perSetupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CAEBDD1-6BEC-4317-9DD3-735D0102D660}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: OracleORA817Agent - Unknown owner - c:\oracle\oracle817\bin\dbsnmp.exe (file missing)
O23 - Service: OracleORA817ClientCache - Unknown owner - c:\oracle\oracle817\BIN\ONRSD.EXE (file missing)
O23 - Service: OracleORA817DataGatherer - Unknown owner - c:\oracle\oracle817\bin\vppdc.exe (file missing)
O23 - Service: OracleORA817HTTPServer - Unknown owner - c:\oracle\oracle817\Apache\Apache\Apache.exe (file missing)
O23 - Service: OracleORA817PagingServer - Unknown owner - c:\oracle\oracle817/bin/pagntsrv.exe (file missing)
O23 - Service: OracleORA817TNSListener - Unknown owner - c:\oracle\oracle817\BIN\TNSLSNR.exe (file missing)
O23 - Service: OracleServiceRC01 - Unknown owner - c:\oracle\oracle817\bin\ORACLE.EXE (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZONELABS\vsmon.exe
O23 - Service: VNC Server (winvnc) - Constantin Kaplinsky - C:\Program Files\TightVNC\WinVNC.exe

–
End of file - 8558 bytes





download speeds still suck
combofix didn't instal recovery console
why remove msconfig??
msconfig should not be in your C:\Winnt\System32 folder. It should be in your c:\winnt\PCHealth\HelpCtr\Binaries folder…. Did you put these in your Host File? O1 - Hosts: 142.101.36.11 cgodcwq002 O1 - Hosts: 142.101.36.13 cgodcwqa02 O1 - Hosts: 142.101.36.5 cgblrwa006 O1 - Hosts: 142.101.36.7 siodcsa002 cgblrsa002 O1 - Hosts: 142.101.36.31 cgblrsq001 O1 - Hosts: 142.101.36.5 CGBLRWA006
i don't have that folder.. no i didn't, and in my host file were a bunch of ip's in the 10.0.0.0 range, private addresses right? any ideas what THAT could be?? here's an ex: 10.128.8.34 sfodcwx500 sefdb
Please download HoxtXpert.
  • Unzip HostsXpert.zip
  • Double click on HostsXpert.exe
  • Then click on "Restore Original Hosts" to restore your Hosts file to its default condidtion..
  • Click on Make Hosts Read Only to secure it against further infection.
  • Close program when complete.

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI