ok, here are mu new logs…thank you!
Symantec Backdoor.Agent.B Removal Tool 1.0.1.2
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=0;pc=3;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1486CbG0K260A0E2G597[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=0;pc=3;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1486DlR0K4M0A1X0r247[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=0;pc=3;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1486DlR0K4M0A1X0r247[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1486DlA0K3a0A2r0M89[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1486NZQ0K3M0A0D16429[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=728x90;ord=1486Cat0K2q0A1P1A108[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1486DlA0K3a0A2r0M89[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1486NZQ0K3M0A0D16429[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=;pc=4;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1486CbM0K260A0E2I33[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\health_pregnancy;svc=;site=pregnancy;t=;pc=5;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1486CbW0K260A0E2K525[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\parenting_pregnancy;svc=;site=pregnancy;t=18;pc=1;fd=1;fs=1;a=;sbj=pid460;kw=;chan=parenting;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=14A1JA90K1a0A370C358[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\19OOTTNH\parenting_pregnancy;svc=;site=pregnancy;t=18;pc=1;fd=1;fs=1;a=;sbj=pid460;kw=;chan=parenting;syn=about;tile=4;r=0;u=0q558q310h4bph;sz=728x91;ord=14A1JA90K1a0A370C358[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\38YJ0MO8\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1485Cvl0K2q0A1d1J618[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\38YJ0MO8\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1485LUR08OkWA3F1C357[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\38YJ0MO8\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1485Cvl0K2q0A1d1J618[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\38YJ0MO8\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1485LUR08OkWA3F1C357[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\85IJCPAF\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1485LUR08OkWA3F1C357[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\85IJCPAF\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=728x90;ord=1485Cvl0K2q0A1d1J618[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\B8B0ONV6\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=728x90;ord=1486Cak0K2q0A1P19735[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\IIGD3ML1\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1486Cat0K2q0A1P1A108[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\IIGD3ML1\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1486NZQ0K3M0A0D16429[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\IIGD3ML1\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1486DlA0K3a0A2r0M89[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\IIGD3ML1\health_pregnancy;svc=;site=pregnancy;t=18;pc=2;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1486Cat0K2q0A1P1A108[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\IIGD3ML1\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=728x90;ord=1486Dl40K3a0A2r0L930[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\IIGD3ML1\health_pregnancy;svc=;site=pregnancy;t=;pc=4;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1486DlY0K4M0A1X0t412[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\O1QJG167\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1485LUH08OkWA3F1B162[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\O1QJG167\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=728x90;ord=1485LUH08OkWA3F1B162[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\O1QJG167\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1485LUH08OkWA3F1B162[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=0;pc=3;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1486CbG0K260A0E2G597[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=0;pc=3;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1486DlR0K4M0A1X0r247[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=0;pc=3;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1486CbG0K260A0E2G597[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1486Cak0K2q0A1P19735[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1486Dl40K3a0A2r0L930[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=1;r=0;u=0q558q310h4bph;sz=728x91;ord=1486NYk0K0M0A2K1E860[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;dcopt=ist;sz=468x60;ord=1486NYk0K0M0A2K1E860[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1486Cak0K2q0A1P19735[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1486Dl40K3a0A2r0L930[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\health_pregnancy;svc=;site=pregnancy;t=1;pc=1;fd=1;fs=1;a=;sbj=pid451;kw=;chan=health;syn=about;tile=2;r=0;u=0q558q310h4bph;sz=120x600;ord=1486NYk0K0M0A2K1E860[1].htm (WARNING: not scanned, path to long)
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QA0V1GD1\parenting_pregnancy;svc=;site=pregnancy;t=18;pc=1;fd=1;fs=1;a=;sbj=pid460;kw=;chan=parenting;syn=about;tile=1;r=0;u=0q558q310h4bph;dcopt=ist;sz=728x90;ord=14A1JA90K1a0A370C[1].htm (WARNING: not scanned, path to long)
C:\System Volume Information: (not scanned)
Backdoor.Agent.B has not been found on your computer.
adaware log
Ad-Aware SE Build 1.05
Logfile Created on:Wednesday, January 26, 2005 9:13:38 AM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R26 25.01.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CoolWebSearch(TAC index:10):4 total references
MRU List(TAC index:0):18 total references
Tracking Cookie(TAC index:3):11 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file
Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects
1-26-2005 9:13:38 AM - Scan started. (Full System Scan)
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\nvidia corporation\global\nview\windowmanagement
Description : nvidia nview cached application window positions
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\windows\currentversion\applets\wordpad\recent file list
Description : list of recent files opened using wordpad
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\mediaplayer\player\recentfilelist
Description : list of recently used files in microsoft windows media player
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer
MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\jasc\paint shop pro 8\recent file list
Description : list of recently used files in jasc paint shop pro
MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\mediaplayer\preferences
Description : last playlist index loaded in microsoft windows media player
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player
MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\winrar\dialogedithistory\extrpath
Description : winrar "extract-to" history
MRU List Object Recognized!
Location: : S-1-5-21-3814911467-654292642-1888680496-1003\software\microsoft\windows media\wmsdk\general
Description : windows media sdk
MRU List Object Recognized!
Location: : C:\Documents and Settings\Owner\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office
MRU List Object Recognized!
Location: : C:\Documents and Settings\Owner\recent
Description : list of recently opened documents
Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 428
ThreadCreationTime : 1-26-2005 12:36:22 PM
BasePriority : Normal
#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 484
ThreadCreationTime : 1-26-2005 12:36:24 PM
BasePriority : Normal
#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 508
ThreadCreationTime : 1-26-2005 12:36:25 PM
BasePriority : High
#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 552
ThreadCreationTime : 1-26-2005 12:36:26 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : services.exe
#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 564
ThreadCreationTime : 1-26-2005 12:36:26 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe
#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 716
ThreadCreationTime : 1-26-2005 12:36:27 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 760
ThreadCreationTime : 1-26-2005 12:36:27 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 828
ThreadCreationTime : 1-26-2005 12:36:27 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:9 [smc.exe]
FilePath : C:\Program Files\Sygate\SPF\
ProcessID : 864
ThreadCreationTime : 1-26-2005 12:36:27 PM
BasePriority : Normal
FileVersion : 5.5.00.2710
ProductVersion : 5.5.00.2710
ProductName : Sygate® Security Agent and Personal Firewall
CompanyName : Sygate Technologies, Inc.
FileDescription : Sygate Agent Firewall
InternalName : Smc
LegalCopyright : Copyright © 1999 - 2004 Sygate Technologies, Inc. All rights reserved.
OriginalFilename : Smc.EXE
#:10 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 988
ThreadCreationTime : 1-26-2005 12:36:29 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:11 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1112
ThreadCreationTime : 1-26-2005 12:36:30 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:12 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 1148
ThreadCreationTime : 1-26-2005 12:36:30 PM
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : EXPLORER.EXE
#:13 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1476
ThreadCreationTime : 1-26-2005 12:36:31 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe
#:14 [hpsysdrv.exe]
FilePath : C:\windows\system\
ProcessID : 1752
ThreadCreationTime : 1-26-2005 12:36:35 PM
BasePriority : Normal
FileVersion : 1, 7, 0, 0
ProductVersion : 1, 7, 0, 0
ProductName : hpsysdrv
CompanyName : Hewlett-Packard Company
FileDescription : hpsysdrv
InternalName : hpsysdrv
LegalCopyright : Copyright © 1998
OriginalFilename : hpsysdrv.exe
#:15 [hkcmd.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1760
ThreadCreationTime : 1-26-2005 12:36:35 PM
BasePriority : Normal
FileVersion : 3.0.0.3889
ProductVersion : 7.0.0.3889
ProductName : Intel® Common User Interface
CompanyName : Intel Corporation
FileDescription : hkcmd Module
InternalName : HKCMD
LegalCopyright : Copyright 1999-2002, Intel Corporation
OriginalFilename : HKCMD.EXE
#:16 [hpgs2wnd.exe]
FilePath : C:\Program Files\Hewlett-Packard\HP Share-to-Web\
ProcessID : 1768
ThreadCreationTime : 1-26-2005 12:36:35 PM
BasePriority : Normal
FileVersion : 2,3,0,0\ 162
ProductVersion : 2,3,0,0\ 162
ProductName : Hewlett-Packard hpgs2wnd
CompanyName : Hewlett-Packard
FileDescription : hpgs2wnd
InternalName : hpgs2wnd
LegalCopyright : Copyright © 2001
OriginalFilename : hpgs2wnd.exe
#:17 [hpqcmon.exe]
FilePath : C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\
ProcessID : 1776
ThreadCreationTime : 1-26-2005 12:36:35 PM
BasePriority : Normal
FileVersion : 1.1.0.121
ProductVersion : 1.1.0.121
ProductName : HpqCmon Application
FileDescription : HpqCmon MFC Application
InternalName : HpqCmon
LegalCopyright : Copyright © 2001
OriginalFilename : HpqCmon.EXE
#:18 [kbd.exe]
FilePath : C:\HP\KBD\
ProcessID : 1784
ThreadCreationTime : 1-26-2005 12:36:35 PM
BasePriority : High
#:19 [ccapp.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 1888
ThreadCreationTime : 1-26-2005 12:36:35 PM
BasePriority : Normal
FileVersion : 1.08.01
ProductVersion : 1.08.01
ProductName : Common Client
CompanyName : Symantec Corporation
FileDescription : Common Client CC App
InternalName : ccApp
LegalCopyright : Copyright © 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : ccApp.exe
#:20 [realsched.exe]
FilePath : C:\Program Files\Common Files\Real\Update_OB\
ProcessID : 1920
ThreadCreationTime : 1-26-2005 12:36:36 PM
BasePriority : Normal
FileVersion : 0.1.0.3018
ProductVersion : 0.1.0.3018
ProductName : RealPlayer (32-bit)
CompanyName : RealNetworks, Inc.
FileDescription : RealNetworks Scheduler
InternalName : schedapp
LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004
LegalTrademarks : RealAudio™ is a trademark of RealNetworks, Inc.
OriginalFilename : realsched.exe
#:21 [msnmsgr.exe]
FilePath : C:\Program Files\MSN Messenger\
ProcessID : 2004
ThreadCreationTime : 1-26-2005 12:36:37 PM
BasePriority : Normal
FileVersion : 6.1.0211
ProductVersion : Version 6.1
ProductName : Messenger
CompanyName : Microsoft Corporation
FileDescription : Messenger
InternalName : msnmsgr
LegalCopyright : Copyright © Microsoft Corporation 1997-2003
LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msnmsgr.exe
CoolWebSearch Object Recognized!
Type : Process
Data : ahlg.dll
Category : Malware
Comment : (CSI MATCH)
Object : C:\WINDOWS\system32\
Warning! CoolWebSearch Object found in memory(C:\WINDOWS\system32\ahlg.dll)
#:22 [hpgs2wnf.exe]
FilePath : c:\Program Files\Hewlett-Packard\HP Share-to-Web\
ProcessID : 2016
ThreadCreationTime : 1-26-2005 12:36:37 PM
BasePriority : Normal
FileVersion : 2, 6, 0, 162
ProductVersion : 2, 6, 0, 162
ProductName : hpgs2wnf Module
FileDescription : hpgs2wnf Module
InternalName : hpgs2wnf
LegalCopyright : Copyright 2001
OriginalFilename : hpgs2wnf.EXE
#:23 [pq.exe]
FilePath : C:\Program Files\PaperQuote\
ProcessID : 2024
ThreadCreationTime : 1-26-2005 12:36:37 PM
BasePriority : Normal
FileVersion : 3.1.3.101
ProductVersion : '01
ProductName : PaperQuote
CompanyName : Everdene L.L.C.
FileDescription : PaperQuote '01
InternalName : PQ
LegalCopyright : Copyright © 1998, 2001 Everdene L.L.C.
LegalTrademarks : PaperQuote TM Everdene L.L.C.
OriginalFilename : PQ.exe
Comments : Daily wallpapers and quotes
#:24 [ccevtmgr.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 252
ThreadCreationTime : 1-26-2005 12:36:39 PM
BasePriority : Normal
FileVersion : 1.03.4
ProductVersion : 1.03.4
ProductName : Event Manager
CompanyName : Symantec Corporation
FileDescription : Event Manager Service
InternalName : ccEvtMgr
LegalCopyright : Copyright © 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : ccEvtMgr.exe
#:25 [crypserv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 368
ThreadCreationTime : 1-26-2005 12:36:40 PM
BasePriority : High
FileVersion : 5.4.0
ProductVersion : 5.4
ProductName : CrypKey Software Licensing System
CompanyName : Kenonic Controls Ltd.
FileDescription : CrypKey NT Service
InternalName : crypserv
LegalCopyright : Copyright © 2000
LegalTrademarks : CrypKey
OriginalFilename : crypserv.exe
Comments : Operates in all directories, not just configured ones. Directory configuration only used for fille clean up and uninstall. 0/3 fixed problem with other partitions. 0/6 fixed problem with short paths
#:26 [navapsvc.exe]
FilePath : C:\Program Files\Norton AntiVirus\
ProcessID : 328
ThreadCreationTime : 1-26-2005 12:36:40 PM
BasePriority : Normal
FileVersion : 9.05.1015
ProductVersion : 9.05.1015
ProductName : Norton AntiVirus
CompanyName : Symantec Corporation
FileDescription : Norton AntiVirus Auto-Protect Service
InternalName : NAVAPSVC
LegalCopyright : Copyright © 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : NAVAPSVC.EXE
#:27 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 3104
ThreadCreationTime : 1-26-2005 12:37:20 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe
#:28 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
ProcessID : 848
ThreadCreationTime : 1-26-2005 3:12:58 PM
BasePriority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
#:29 [msmsgs.exe]
FilePath : C:\Program Files\Messenger\
ProcessID : 2672
ThreadCreationTime : 1-26-2005 3:13:10 PM
BasePriority : Normal
FileVersion : 4.7.3000
ProductVersion : Version 4.7.3000
ProductName : Messenger
CompanyName : Microsoft Corporation
FileDescription : Windows Messenger
InternalName : msmsgs
LegalCopyright : Copyright © Microsoft Corporation 2004
LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msmsgs.exe
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 19
Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 19
Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 19
Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@questionmarket[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:[removed]/
Expires : 3-16-2006 12:59:18 AM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@tribalfusion[1].txt
Category : Data Miner
Comment : Hits:4
Value : Cookie:[removed]/
Expires : 12-31-2037 6:00:00 PM
LastSync : Hits:4
UseCount : 0
Hits : 4
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@2o7[2].txt
Category : Data Miner
Comment : Hits:38
Value : Cookie:[removed]/
Expires : 1-24-2010 9:09:02 AM
LastSync : Hits:38
UseCount : 0
Hits : 38
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@apmebf[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:[removed]/
Expires : 1-24-2010 8:27:20 PM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : [removed][1].txt
Category : Data Miner
Comment : Hits:3
Value : Cookie:[removed]/
Expires : 1-24-2006 10:03:20 AM
LastSync : Hits:3
UseCount : 0
Hits : 3
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@casalemedia[1].txt
Category : Data Miner
Comment : Hits:8
Value : Cookie:[removed]/
Expires : 1-16-2006 8:23:02 AM
LastSync : Hits:8
UseCount : 0
Hits : 8
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@centrport[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:[removed]/
Expires : 12-31-2029 6:00:00 PM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@serving-sys[1].txt
Category : Data Miner
Comment : Hits:5
Value : Cookie:[removed]/
Expires : 12-31-2037 11:00:00 PM
LastSync : Hits:5
UseCount : 0
Hits : 5
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@bluestreak[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:[removed]/
Expires : 1-23-2015 3:31:58 PM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : [removed]-sys[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:[removed]/
Expires : 12-31-2037 11:00:00 PM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : owner@trafic[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:[removed]/
Expires : 1-11-2037 8:00:00 AM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 11
Objects found so far: 30
Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 30
Deep scanning and examining files (D:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Disk Scan Result for D:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 30
Scanning Hosts file……
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 30
Performing conditional scans…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CoolWebSearch Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment : CWS.About:Blank
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\searchassistant uninstall
CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment : CWS.About:Blank
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\searchassistant uninstall
Value : DisplayName
CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment : CWS.About:Blank
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\searchassistant uninstall
Value : UninstallString
Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 3
Objects found so far: 33
9:35:07 AM Scan Complete
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:21:29.276
Objects scanned:176710
Objects identified:14
Objects ignored:0
New critical objects:14
Logfile of HijackThis v1.99.0
Scan saved at 10:30:43 AM, on 1/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PaperQuote\PQ.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
http://comcast.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r5.attbi.com;localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [BlockTracker] c:\hp\bin\BlockTracker.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ipnwsle] "C:\WINDOWS\System32\ipnwsle.exe"
O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PaperQuote '01] C:\Program Files\PaperQuote\PQ.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Startup: server[1].exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google; Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links; - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed; Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar; Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: TruePass EPF 7,0,0,478 -
https://pki.revenue.state.il.us/app/truepas…sapplet-epf.cab
O16 - DPF: {31932A5C-9234-4377-A920-72E7DD340DB4} (Snapfish File Upload ActiveX Control) -
http://www.snapfish.com/SnapfishUpload.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
http://software-dl.real.com/065cf0dc874bc7…ip/RdxIE601.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} (InstallShield Setup Player 2K2) -
http://www.cyberpatrol.com/cponline/setup.exe
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe
WHEW!:)
hijack this log
thanks!